SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Race Driver Vendors:   Codemasters Software Company Limited
Race Driver Format String and Buffer Overflow Flaws May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1014519
SecurityTracker URL:  http://securitytracker.com/id/1014519
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jul 19 2005
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 1.20 and prior versions
Description:   Luigi Auriemma reported a vulnerability in the Race Driver game software. A remote user can cause the application to crash or potentially execute arbitrary code.

The software contains a format string and buffer overflow vulnerability that can be triggered by a remote user via the public chat feature or via the server browser.

A remote user can send a specially crafted chat message or use a specially crafted nickname to trigger the vulnerability.

A remote user can also host a game with a name value of '%n%n%n' to trigger the vulnerability.

Impact:   A remote user can cause the target user's client to crash or potentially execute arbitrary code.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.codemasters.com/ (Links to External Site)
Cause:   Boundary error, Input validation error, State error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Broadcast format string and buffer-overflow in Race Driver 1.20



#######################################################################

                             Luigi Auriemma

Application:  Race Driver
              http://www.codemasters.com/tocaracedriver/
Versions:     <= 1.20
Platforms:    Windows
Bugs:         A] broadcast format string
              B] broadcast buffer-overflow
Exploitation: remote, versus any user in the public chat or through
              malformed server replies (broadcast)
Date:         18 Jul 2005
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Race Driver is a funny but poorly supported racing game developed and
published by Codemasters (http://www.codemasters.com).
It has been released in March 2003.


#######################################################################

======
2) Bug
======


Race Driver incorrectly uses sprintf() for building different types of
text strings usually used for the visualization of the data.
The places where this bad sprintf() can be exploited are at least 2:
the public chat hosted on the encrypted IRC server peerchat.gamespy.com
and the in-game server browser.

The public chat is a place used by Race Driver while the users wait for
a free server to join. The users automatically join it when they choose
to play on Internet from the Network menu... it is an useless but
forced stage.
Other than the messages in the channel the game supports also the
private messages (whispers) so an attacker can decide to attack a
specific user or just all the users in the room.

The in-game server browser instead is where are showed and ordered the
online servers through the informations received in their replies.

The sprintf() function is affected by two bugs: a format string and a
buffer-overflow caused by text strings of 264 chars.


#######################################################################

===========
3) The Code
===========


For testing the bugs through the chat is enough to use the same game or
an IRC client with a Peerchat proxy.
The example chat messages (or also nicknames) for exploiting the bugs
are the following:
   %n%n%n
 and
  
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaRETA

The raw names of the channels used by Race Driver are: #GPG!511 (the
main), #GPG!510, #GPG!508, #GPG!507, #GPG!506, #GPG!509, #GPG!513,
#GPG!512, #GPG!485, #GPG!486 and (for some milliseconds)
#GSP!racedriver

For testing the bugs through a malicious server you need only to host a
game with the name %n%n%n.


#######################################################################

======
4) Fix
======


This game is no longer supported.


#######################################################################


--- 
Luigi Auriemma 
http://aluigi.altervista.org 
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC