SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Ratbag Games (Various Titles) Vendors:   Ratbag
Ratbag Games Packet Length State Error Lets Remote Users Crash the Game
SecurityTracker Alert ID:  1009025
SecurityTracker URL:  http://securitytracker.com/id/1009025
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 12 2004
Impact:   Denial of service via network
Exploit Included:  Yes  

Description:   A denial of service vulnerability was reported in several games by Ratbag. A remote user can cause the game server to freeze.

Luigi Auriemma reported that a remote user can send a specially crafted packet to cause the server to reach 100% CPU utilization and freeze. A packet that specifies a certain number of bytes but does not deliver all of the bytes will cause the server to wait indefinitely for the remaining data, the report said.

Affected games include Dirt Track Racing (1.03 and prior versions), Dirt Track Racing Australia, Leadfoot, Dirt Track Racing Sprint Cars (1.01 and prior versions), Dirt Track Racing 2, and World of Outlaws Sprint Cars.

Some demonstration exploit code is available at:

http://aluigi.altervista.org/poc/ratbagcpu.zip

The vendor has reportedly been notified.

Impact:   A remote user can cause the target server to consume all CPU resources and freeze.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.ratbaggames.com/ (Links to External Site)
Cause:   State error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Denial of Service in Ratbag's game engine



#######################################################################

                             Luigi Auriemma

Application:  Game engine and games developed by Ratbag
              http://www.ratbaggames.com
Games/Ver:    - Dirt Track Racing             <= 1.03
              - Dirt Track Racing Australia
              - Leadfoot
              - Dirt Track Racing Sprint Cars <= 1.01
              - Dirt Track Racing 2
              - World of Outlaws Sprint Cars
Platforms:    Windows
Bug:          CPU at 100%, match freezed
Risk:         medium/high
Exploitation: remote, versus server
Date:         11 Feb 2004
Author:       Luigi Auriemma
              e-mail: aluigi@altervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Ratbag is a software house enough famous in the gaming scene for its
racing games based on "dirty" racing sports.
Just its most famous game Dirt Track Racing in fact has winned some
awards in the past.


#######################################################################

======
2) Bug
======


The bug is a freezing of the server (CPU up to 100%) caused by the
value identifying the length of the data.
This value is the first 16 bit number that is located at the beginning
of each data block, it is read by the server to know how many bytes
must be read and to calculate the amount of remaining data to receive
from the socket to complete the data block.

The problem is located just in the management of the sockets in fact
the Ratbag engine uses TCP connections on non-blocked sockets so
everytime that there are remaining bytes to read the game will do an
infinite check on the socket to know if are arrived new data.

So for example if an attacker uses the value 3 but sends only 2 bytes,
the remaining byte will cause the infinite loop because naturally he
will stay connected and will never send this last byte.


#######################################################################

===========
3) The Code
===========


   http://aluigi.altervista.org/poc/ratbagcpu.zip


#######################################################################

======
4) Fix
======


No fix.
No reply to my signalations.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC