lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20040323184851.621c8899.aluigi@altervista.org>
From: aluigi at altervista.org (Luigi Auriemma)
Subject: Server freeze in The Rage 1.01

#######################################################################

                             Luigi Auriemma

Application:  The Rage
              http://www.therageonline.com
Versions:     <= 1.01
Platforms:    Windows
Bug:          server freeze
Risk:         low
Exploitation: remote, versus server
Date:         23 Mar 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Rage is an old school beat'em up game developed by the italians
Fluidgames (http://www.fluidgames.net).


#######################################################################

======
2) Bug
======


The packet used by the client to join the match hosted on the server
contains a sockaddr_in structure inside the data that (naturally) is
composed by the AF_INET family, the source port and the IP address of
the client.

This structure is used by the server to send the next packets to the
client but if an attacker fill it with a port and an IP equal to zero
the server will enter in an infinite loop (from offset 0043525b to
0043527f of the decrypted executable) that completely freezes it.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/ragefreeze.zip


#######################################################################

======
4) Fix
======


The game is no longer supported.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org


Powered by blists - more mailing lists