full-disclosure - NULL pointer in ZDaemon 1.08.07

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20080722000221.dca1db65.aluigi@autistici.org>
Date: Tue, 22 Jul 2008 00:02:21 +0100
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	packet@...ketstormsecurity.org, cert@...t.org, news@...uriteam.com
Subject: NULL pointer in ZDaemon 1.08.07


#######################################################################

                             Luigi Auriemma

Application:  ZDaemon
              http://www.zdaemon.org
Versions:     <= 1.08.07
Platforms:    Windows and Linux
Bug:          NULL pointer
Exploitation: remote, versus server (in-game)
Date:         21 Jul 2008
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


ZDaemon is one of the most played multiplayer ports of the Doom engine
and at the same time one of the most criticized too.


#######################################################################

======
2) Bug
======


The ZDaemon server is affected by a NULL pointer vulnerability which
allows an attacker to crash it when a specific type of command (type 6)
is used.

The attacker needs to join the server for exploiting this bug so his IP
address must be not banned and he must know the right keyword if the
server is protected with a password.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/zdaemonull.zip


#######################################################################

======
4) Fix
======


No fix


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org
http://backup.aluigi.org
http://mirror.aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/