full-disclosure - Server termination in Scrapland 1.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050228184429.050ddc9a.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Server termination in Scrapland 1.0


#######################################################################

                             Luigi Auriemma

Application:  Scrapland
              http://www.scrapland.com
Versions:     <= 1.0
Platforms:    Windows
Bug:          server termination
Exploitation: remote, versus server (partially in-game)
Date:         28 Feb 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Scrapland is the known game developed by MercurySteam Entertainment
(http://www.mercurysteam.com) with the creative support of American
McGee (http://www.americanmcgee.com).
The game has been released at the beginning of 2005.


#######################################################################

======
2) Bug
======


The main problem of the game is that the server terminates after any
error instead of simply showing the error message in the game console
and continuing its work.

This situation lets an attacker to easily crash a Scrapland game server
in many ways, some of them are:

- size>SSize: the game uses 8 bits numbers to specify the size of the
  text strings inside the packets. These 8 bits numbers are handled as
  signed integers so any value bigger than 127 causes the server error.

- unexistent model: if the client uses a model (like engine, pilot or
  player) not available on the server, this one will terminate saying
  that the model specified by the client has not been found.

- newpos<=size: another type of error.

- access violation caused by the reception of two partial packets.

If the server is full, is not possible to terminate it.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/scrapboom.zip


#######################################################################

======
4) Fix
======


No fix.
No reply from the developers.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org