full-disclosure - Soldier of Fortune II format string through PunkBuster 1.180

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu Feb 16 22:04:23 2006
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Soldier of Fortune II format string through
	PunkBuster 1.180

#######################################################################

                             Luigi Auriemma

Application:  Soldier of Fortune II with PunkBuster enabled
              http://www.ravensoft.com/soldier2.html
              http://www.PunkBuster.com
Versions:     PB for server <= 1.180
Platforms:    Windows, Linux and Mac
Bug:          format string
Exploitation: remote, versus server (in-game)
Date:         16 Feb 2006
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

PunkBuster is a loved/hated anti-cheat system developed by Even Balance
(http://www.evenbalance.com) and officially used in many diffused games
like America's Army, Battlefield 1942/Vietnam/II, Call of Duty, Doom 3
and almost all the games based on the Quake 3 engine.

Although the bug I have found has been exploited only in Soldier of
Fortune II I cannot exclude other games which I have not tested
personally (no reply from the vendor).

#######################################################################

======
2) Bug
======

The PunkBuster server module supports the automatic kick and ban of the
players which use invalid cvars, for example with values outside the
range specified by the server.
When this situation occurs PB kicks the client using the game's
functions (like a clientkick command).
The message sent to the client contains both the name of the monitored
cvar and its value on the client, the resulted string is identified as
"reason".

The problem is that naturally Soldier of Fortune II makes no checks on
the "reason" parameter (watch trap_DropClient) which is passed by PB or
by the server admin for kicking a player, so the subsequent sprintf()
call is vulnerable to a format string attack.

Normally there is no way to exploit this bug if you are not the server
administrator (typing: clientkick 0 %n%n%n%n%n) but PunkBuster is the
way which allows any player inside the server to crash or possibly take
the control of the remote system.

#######################################################################

===========
3) The Code
===========

- launch a client
- join a server (naturally with PunkBuster enabled)
- type /pb_cvarlist
- choose one of the monitored cvars like "snaps" for example
- type:    /set CVAR %n%n%n%n%n%n
  example: /set snaps %n%n%n%n%n%n
- the server will crash after some second during the kicking of the
  client

#######################################################################

======
4) Fix
======

Evenbalance has silently fixed the bug after my report but I have
received no reply and there are no details on the PunkBuster website
about this bug or what has been exactly patched.
In the same day have been released also updated PB servers for other
games.
No comment...

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org