full-disclosure - In-game server buffer-overflow in Jedi Academy 1.011

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050402184908.6748323f.aluigi@autistici.org>
Date: Mon Apr  4 13:00:00 2005
From: aluigi at autistici.org (Luigi Auriemma)
Subject: In-game server buffer-overflow in Jedi Academy
	1.011

#######################################################################

                             Luigi Auriemma

Application:  Star Wars Jedi Knight: Jedi Academy
              http://www.lucasarts.com/products/jediacademy/
Versions:     <= 1.011
Platforms:    Windows, Linux and Mac
Bug:          buffer-overflow during the visualization of big messages
Exploitation: remote, versus server (in-game)
Date:         02 Apr 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Jedi Academy is a first person shooter that uses the Quake 3 engine,
it's developed by Raven Software (http://www.ravensoft.com) and has
been released in September 2003.

#######################################################################

======
2) Bug
======

The game is affected by a buffer-overflow in the visualization function
called G_Printf().
This function uses a sprintf() with a local buffer of 1024 bytes where
it stores the text to display in the console so if an attacker sends a
big message (through the commands say and tell for example) the server
calls G_Printf() for visualizing a string like the following example:

  say: NICKNAME: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...aaaaaaaa\n

The result is that an attacker could execute malicious code on the
victim server.
The only limitation is that this is an in-game bug so the attacker must
have access to the server, if it's protected by password he must know
the keyword.

#######################################################################

===========
3) The Code
===========

- download the following file:
    http://aluigi.altervista.org/poc/jamsgbof.cfg
- place it in the base folder of the game: GameData\base
- start a client and a server
- join the server
- go into the client console (shift + ~)
- type: /exec jamsgbof
- the server will crash with the return address overwritten with
  0x61616161

#######################################################################

======
4) Fix
======

No fix.
The game "should" be no longer supported.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org