Message-Id: <20070819000452.2aa81e14.aluigi@autistici.org>
Date: Sun, 19 Aug 2007 00:04:52 +0200
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, full-disclosure@...ts.grok.org.uk, vuln@...unia.com,
	packet@...ketstormsecurity.org
Subject: Unexploitable buffer-overflow in the logging
 function of the Unreal engine


#######################################################################

                             Luigi Auriemma

Application:  Unreal engine
              http://www.unrealtechnology.com
              http://www.epicgames.com
Versions:     this engine is used in many games like Unreal Tournament
              2003 and 2004 (both vulnerables) and I have not tested
              them all although I'm enough sure that almost all are
              vulnerables
Platforms:    Windows, Linux and Mac
Bugs:         A] unexploitable buffer-overflow in the logging function
              B] web admin hell bell on Windows dedicated servers
Exploitation: A] remote versus server
              B] remote versus Windows dedicated server only
Date:         18 Aug 2007
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Unreal engine is a game engine developed by EpicGames
(http://www.epicgames.com) used in many famous commercial games of
which the main example is the just lucky Unreal Tournament series.


#######################################################################

=======
2) Bugs
=======

--------------------------------------------------------
A] unexploitable buffer-overflow in the logging function
--------------------------------------------------------

The logging function used in the Unreal engine (and which seems not
possible to disable) is vulnerable to a buffer-overflow bug.
The message passed to this function is used with appSprintf() for
building the following unicode string using an output buffer of 1024
unicode chars:

  appSprintf(unicode_buffer, "%s: %s%s", "Log", message, "\r\n");

the appSprintf function works exactly as snprintf truncating the buffer
automatically at 1024 unicode chars without adding the final NULL byte
at the end if this limit is reached.
Then the unicode_buffer is converted in an ascii string using a set of
instructions similar to the following:

    for(i = 0; (cx = unicode_buffer[i]); i++) {
        if(cx >= 256) cx = 0x7f;
        ascii_buffer[i] = cx;
    }

the instructions are enough corrects but unfortunately the destination
ascii buffer is located in the stack just after the unicode_buffer and
as already said this one is not delimited if the 1024 chars limit is
reached.
The result is that after 1024 unicode chars the instructions will start
to get the unicode chars located in the output ascii buffer.
The input chars are unicode chars (16 bit) and so those in the ascii
buffer are ever major than the 256 number (0x0100) forcing the
instructions to continue to put 0x7f chars until a NULL byte is finally
reached... and in the meantime the return address has been completely
overwritten by 0x7f7f7f7f.

During my tests only UnrealTournament (version 451b) wasn't vulnerable
because its appSprintf delimits the destination unicode buffer.

How to exploit this vulnerability?

For the moment I have found only the Unreal web server as way for
exploiting this Denial of Service since it allows the sending and
moreover the visualization of more than 1024 chars, but other better
ways could exist.

The internal web server built in the Unreal engine is a service useful
for managing the own game server remotely through a web browser.
This server is NOT enabled by default and works on port 80 if the admin
doesn't change it.
The files pointed by the server are those contained in the Web folder
inside the game directory and /images is the only one which doesn't
require authorization, and is also the one needed to exploit this bug.


---------------------------------------------------
B] web admin hell bell on Windows dedicated servers
---------------------------------------------------

This type of Denial of Service could seem something like a joke but it
works terribly well.
The non-graphical dedicated server of the Unreal engine (UCC) works in
console and in some specific occasions it displays some of the data
sent by the clients.

The main idea behind this bug is forcing the server to visualize some
invalid chars like the bell (0x07) for freezing partially the system
and moreover the online game since the Windows console will start to
beep without a break.
In these cases the only way to stop the attack is killing the process
and its console.

The only good way I have found for exploiting this problem on the
Unreal engine with a big amount of chars is through the web admin port
since the invalid chars like 0x07 are not filtered.
Some ways for exploiting the problem are requests to the /images
folder, the Content-Type field using POST, any HEAD query and so on.

This bug can be exploited only versus the UCC Windows dedicated server,
since the in-game dedicated server has its own graphical interface and
on Linux and other operating systems there is no system freeze caused
by the bell... and sincerely I have never understood why the Windows
console has a so stupid problem.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/unrwebdos.zip


#######################################################################

======
4) Fix
======


No fix.
No reply received from the developers.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists