full-disclosure - Format string and crash in Warrior Kings 1.3 and Battles 1.23

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050523172447.3d84cfeb.aluigi@autistici.org>
Date: Mon May 23 16:36:46 2005
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Format string and crash in Warrior Kings 1.3 and
	Battles 1.23

#######################################################################

                             Luigi Auriemma

Application:  Warrior Kings: Battles
                http://www.warriorkingsbattles.com
              Warrior Kings

http://www.empireinteractive.com/games/product.asp?PID=CCD3E776-8DDB-4A4C-8A19-922D58804A24
Versions:     Warrior Kings: Battles <= 1.23
              Warrior Kings          <= 1.3
Platforms:    Windows
Bugs:         A] format string
              B] crash
Exploitation: remote, versus server
Date:         23 May 2005
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Warrior Kings: Battles is a real-time strategy game developed by
Black Cactus (http://www.blackcactus.co.uk) and released in March 2003.
The game is published by Empire Interactive and Strategy First.

Warrior Kings instead is published by Microids and Empire Interactive
and has been released exactly one year before its successor.

#######################################################################

=======
2) Bugs
=======

----------------
A] format string
----------------

The game is affected by a format string bug in the function used to
visualize the text on the screen. The best and simplest way to exploit
the bug is through a malformed nickname.
The only limitation is that the attacker cannot exploit the bug if the
server is locked.

--------
B] crash
--------

A partial join packet causes the crash of the server due to the access
to a NULL pointer.
Only Warrior Kings Battles seems affected by this problem.

#######################################################################

===========
3) The Code
===========

http://aluigi.altervista.org/poc/wkbbugs.zip
http://aluigi.altervista.org/poc/warkingsfs.zip

#######################################################################

======
4) Fix
======

No fix.
No reply from the vendor.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org