SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Scrapland Vendors:   MercurySteam
Scrapland Game Server Can Be Crashed By Remote Users
SecurityTracker Alert ID:  1013319
SecurityTracker URL:  http://securitytracker.com/id/1013319
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 28 2005
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 1.0 and prior versions
Description:   Luigi Auriemma reported a vulnerability in the Scrapland game. A remote user can cause the game server to crash.

The game server will terminate when an error occurs. A remote user can trigger an error condition to cause the game server to terminate. Some methods to cause error conditions are described below.

A remote user can specify a 'size>SSize' value larger than 127 to cause a server error.

A remote user can specify a model (e.g., engine, pilot, player) that is not available on the server to cause a server error.

A remote user can specify a 'newpos<=size' value to cause a server error.

A remote user can send two partial packets to cause a server error.

A demonstration exploit is available at:

http://aluigi.altervista.org/poc/scrapboom.zip

The vendor was notified without response.

Impact:   A remote user can cause the game server to terminate.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.mercurysteam.com/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Server termination in Scrapland 1.0



#######################################################################

                             Luigi Auriemma

Application:  Scrapland
              http://www.scrapland.com
Versions:     <= 1.0
Platforms:    Windows
Bug:          server termination
Exploitation: remote, versus server (partially in-game)
Date:         28 Feb 2005
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Scrapland is the known game developed by MercurySteam Entertainment
(http://www.mercurysteam.com) with the creative support of American
McGee (http://www.americanmcgee.com).
The game has been released at the beginning of 2005.


#######################################################################

======
2) Bug
======


The main problem of the game is that the server terminates after any
error instead of simply showing the error message in the game console
and continuing its work.

This situation lets an attacker to easily crash a Scrapland game server
in many ways, some of them are:

- size>SSize: the game uses 8 bits numbers to specify the size of the
  text strings inside the packets. These 8 bits numbers are handled as
  signed integers so any value bigger than 127 causes the server error.

- unexistent model: if the client uses a model (like engine, pilot or
  player) not available on the server, this one will terminate saying
  that the model specified by the client has not been found.

- newpos<=size: another type of error.

- access violation caused by the reception of two partial packets.

If the server is full, is not possible to terminate it.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/scrapboom.zip


#######################################################################

======
4) Fix
======


No fix.
No reply from the developers.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC