####################################################################### Luigi Auriemma Application: Alien Arena 2006 Gold Edition http://red.planetarena.org Versions: <= 5.00 Platforms: Windows and Linux Bugs: A] safe_cprintf server format string B] Cmd_Say_f server buffer-overflow C] Com_sprintf crash Exploitation: A] remote, versus server (in-game) B] remote, versus server (in-game) C] remote, versus clients and server (in-game) Date: 07 Mar 2006 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Alien Arena 2006 GE is the latest release of the CodeRED series, an open source game developed on an enhanced version (CRX engine) of the GPLed Quake II engine. The game supports both LAN and Internet multiplayer. ####################################################################### ======= 2) Bugs ======= All the bugs need to be exploited in-game so the attacker's IP must be not banned and he must know the right keyword if the server is protected by password. I have found no ways to exploit them "externally". ------------------------------------ A] safe_cprintf server format string ------------------------------------ The safe_cprintf() function used by the server for sending messages to the clients is affected by a format string vulnerability which could allow the execution of malicious code. After having built the output string the function passes it as format argument (yes it's just like a double sprintf) to gi.cprintf() -> "void PF_cprintf (edict_t *ent, int level, char *fmt, ...)". From games/acesrc/acebot_cmds.c: void safe_cprintf (edict_t *ent, int printlevel, char *fmt, ...) { char bigbuffer[0x10000]; va_list argptr; int len; if (ent && (!ent->inuse || ent->is_bot)) return; va_start (argptr,fmt); len = vsprintf (bigbuffer,fmt,argptr); va_end (argptr); gi.cprintf(ent, printlevel, bigbuffer); } ----------------------------------- B] Cmd_Say_f server buffer-overflow ----------------------------------- The function Cmd_Say_f is used by the server for handling the text messages received from the clients. Cmd_Say_f uses a buffer of 2048 bytes in which puts the nickname of the player who has sent the message using the secure (enough secure) Com_sprintf() function followed by strcat() for appending the received message. These instructions allow an attacker to exploit the resulted buffer-overflow for executing malicious code. From source/game/g_cmds.c: void Cmd_Say_f (edict_t *ent, qboolean team, qboolean arg0) { int i, j; edict_t *other; char *p; char text[2048]; gclient_t *cl; if (gi.argc () < 2 && !arg0) return; if ((!((int)(dmflags->value) & (DF_MODELTEAMS | DF_SKINTEAMS))) || (!ctf->value)) team = false; if (team) Com_sprintf (text, sizeof(text), "(%s): ", ent->client->pers.netname); else Com_sprintf (text, sizeof(text), "%s: ", ent->client->pers.netname); if (arg0) { strcat (text, gi.argv(0)); strcat (text, " "); strcat (text, gi.args()); } else { p = gi.args(); if (*p == '"') { p++; p[strlen(p)-1] = 0; } strcat(text, p); } ... -------------------- C] Com_sprintf crash -------------------- The Com_sprintf() function is a custom snprintf() replacement widely used in the code. The only problem of this function (usually bigbuffer is enough big so doesn't represent a risk) is caused by the final strncpy() call which is not followed by an instruction for delimiting dest with a NULL byte. Often, depending by the system/compiler, this lack leads to a crash. In my tests I were able to crash the precompiled Windows clients without problems through a skin of about 110 chars (MAX_OSPATH is 128). In fact one of the best ways for exploiting this bug is just using a player with a long skin, weapon or model name so any client which is inside or will join the server while the attacker is playing will be crashed immediately. In this case we can watch the exploitation in the function CL_LoadClientinfo() located in client/cl_parse.c. From source/game/q_shared.c: void Com_sprintf (char *dest, int size, char *fmt, ...) { int len; va_list argptr; char bigbuffer[0x10000]; va_start (argptr,fmt); len = vsprintf (bigbuffer,fmt,argptr); va_end (argptr); if (len >= size) Com_Printf ("Com_sprintf: overflow of %i in %i\n", len, size); strncpy (dest, bigbuffer, size-1); } ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/aa2k6x.zip ####################################################################### ====== 4) Fix ====== No fix. The developers will release a patch the next months. #######################################################################