full-disclosure - Broadcast crash in Xpand Rally 1.0.0.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050130202611.56d0a76a.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Broadcast crash in Xpand Rally 1.0.0.0


#######################################################################

                             Luigi Auriemma

Application:  Xpand Rally
              http://www.xpandrally.com
Versions:     1.0.0.0
Platforms:    Windows
Bug:          reading and writing on unallocated memory (crash)
Exploitation: remote, versus server and clients (broadcast)
Date:         30 Jan 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Xpand Rally is the recent rally game developed by Techland
(http://www.techland.pl) and released in September 2004.


#######################################################################

======
2) Bug
======


The problem is caused by an unchecked memory allocation controlled by
the attacker that can decide the exact amount of data to allocate
through a 32 bits number in his packets.

If the memory to allocate is too big the malloc() function will fail
and no instructions will check it so the game will try to write into a
bad memory zone (0x00000000)

Instead if the number is enough big but can be allocated, memcpy() will
fail because will try to read the unallocated memory after the packet's
data.

Naturally also clients are affected and a malicious server visible in
the master server list is able to passively crash any vulnerable client
in the world.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/xprallyboom.zip


#######################################################################

======
4) Fix
======


Version 1.1.0.0.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org