SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Team Factor Vendors:   7FX
7FX Team Factor Integer Overflow Lets Remote Users Crash the Game Server
SecurityTracker Alert ID:  1009153
SecurityTracker URL:  http://securitytracker.com/id/1009153
CVE Reference:   CVE-2004-0321   (Links to External Site)
Updated:  Mar 23 2004
Original Entry Date:  Feb 20 2004
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 1.25/1.25m and prior versions
Description:   A vulnerability was reported in 7FX's Team Factor game software. A remote user can cause the game server to crash.

Luigi Auriemma reported that a remote user can send a specially crafted packet to trigger the flaw. The software reportedly accepts a user-supplied value to determine the size of a data block to be read. A remote user can supply a negative value to cause the game to read from unallocated memory and crash, the report said.

Some demonstration exploit code is available at:

http://aluigi.altervista.org/poc/tfboom.zip

The original advisory is available at:

http://aluigi.altervista.org/adv/tfboom-adv.txt

The vendor has reportedly been notified without response.

Impact:   A remote user can cause the game server to crash.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.7fx.com/pcgames.html (Links to External Site)
Cause:   Boundary error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  http://aluigi.altervista.org/adv/tfboom-adv.txt


http://aluigi.altervista.org/adv/tfboom-adv.txt

#######################################################################

                              Luigi Auriemma

Application:  Team Factor (aka US Special Forces)
               http://www.teamfactor.co.uk/
               http://ms7fx.iccc.cz/teamfactor/
Versions:     <= 1.25
               (note: 1.25 and 1.25m uses the same vulnerable exe)
Platforms:    Windows and Linux
Bug:          reading of unallocated memory (crash)
Risk:         high
Exploitation: remote, versus server
Date:         20 Feb 2004
Author:       Luigi Auriemma
               e-mail: aluigi@altervista.org
               web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


 From developers'site:

"Team Factor is a stand-alone multi-player action game designed with
team play in mind. The games mission, environment and objective is
inspired by the 'shadow' military operations - whether real or fiction
style."


#######################################################################

======
2) Bug
======


At offset 12 of each packet there is a 16bit value used to specify the
size of the data block that follows it.
This value is read as a signed short so if we use a negative value the
game will read unallocated memory (memcpy() instruction) and will
crash immediately.
The following are the instructions that cause the crash in the Win32
1.25 version:

:00530D23 0FBF6C240E              movsx ebp, word ptr [esp+0E]
...
:00530D6B F3A5                    repz movsd

:00530D23   16bit value read as signed short, movsx
:00530D6B   copying of the data block into the new buffer, memcpy()


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/tfboom.zip


#######################################################################

======
4) Fix
======


No fix.
Developers have not answered to my mails.

Fortunally fixing the problem is very simple in fact we must only
manage the 16bit value as an UNsigned short instead of a signed short:

from :00530D23 0FBF6C240E              movsx ebp, word ptr [esp+0E]
to   :00530D23 0FB76C240E              movzx ebp, word ptr [esp+0E]

My unofficial patch for the Win32 version 1.25/m is available here:

   http://aluigi.altervista.org/patches/tfboomw125.zip


#######################################################################


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC