lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20040323184851.621c8899.aluigi@altervista.org> From: aluigi at altervista.org (Luigi Auriemma) Subject: Server freeze in The Rage 1.01 ####################################################################### Luigi Auriemma Application: The Rage http://www.therageonline.com Versions: <= 1.01 Platforms: Windows Bug: server freeze Risk: low Exploitation: remote, versus server Date: 23 Mar 2004 Author: Luigi Auriemma e-mail: aluigi@...ervista.org web: http://aluigi.altervista.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== The Rage is an old school beat'em up game developed by the italians Fluidgames (http://www.fluidgames.net). ####################################################################### ====== 2) Bug ====== The packet used by the client to join the match hosted on the server contains a sockaddr_in structure inside the data that (naturally) is composed by the AF_INET family, the source port and the IP address of the client. This structure is used by the server to send the next packets to the client but if an attacker fill it with a port and an IP equal to zero the server will enter in an infinite loop (from offset 0043525b to 0043527f of the decrypted executable) that completely freezes it. ####################################################################### =========== 3) The Code =========== http://aluigi.altervista.org/poc/ragefreeze.zip ####################################################################### ====== 4) Fix ====== The game is no longer supported. ####################################################################### --- Luigi Auriemma http://aluigi.altervista.org
Powered by blists - more mailing lists