####################################################################### Luigi Auriemma Application: IGI 2: Covert Strike http://www.igi2-game.com Versions: <= 1.3 Platforms: Windows, Linux Bug: format string bug Exploitation: remote, versus server Date: 05 Apr 2004 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== IGI 2 is a tactical stealth-based FPS game developed by Innerloop (http://www.innerloop.com) and published by Codemasters (http://www.codemasters.com). It has been released in February 2003. ####################################################################### ====== 2) Bug ====== The IGI 2 server is affected by a format string bug in the logging function of the RCON commands. FYI, RCON commands are used by admins to administer their servers remotely. This function exists in both dedicated and normal servers and cannot be disabled. A practical example of the bug "in action" is the following: - Attacker sends: /hello-%08x.%08x.%08x.%08x - Server logs: [17:17:28] Consoled: 'hello-082aeefc.00000131.0061b64c.00000011' run from 192.168.0.3:32768 Update: The bug is caused by the logging function NetManager_LogMessage which takes the text to dump, adds a timestamp (using snprintf) and then passes the whole string to the function File_printf without the needed format argument (%s). ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/igi2fs.zip ####################################################################### ====== 4) Fix ====== No fix. Developers have not replied to my mails. Update: http://aluigi.org/patches/igi2fsfix.lpatch http://aluigi.org/patches/igi2fsfix_linux.lpatch #######################################################################