#######################################################################

                             Luigi Auriemma

Application:  Serious Sam engine
              http://www.seriousengine.com
Versions:     Versions using TCP protocol in multiplayer:
              - SeriousSam: the First Encounter <= 1.05
              - SeriousSam: the Second Encounter <= 1.05 (1.07 is NOT
                vulnerable)
              - Demos of Serious Sam test 2 2.1a and the demo of the
                Second encounter (oh yeah they are demos but there are
                people that use them)
              - probably also other games based on this engine but I
                wasn't able to test them
Platforms:    Windows
Bug:          Remote crash of the server caused by malformed data
Date:         30 Oct 2003
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Serious Sam engine is the great game's engine developed by Croteam.
The games based on this engine are "Serious Sam: the first encounter",
"Serious Sam: the second encounter", "Deer Hunter 2003" and
"Carnivores: Cityscape" (probably others?).

As said in the header of this advisory, ONLY the games or the versions
of the engine that use the TCP protocol are vulnerables, in fact the
version 1.07 of "Serious Sam: the second encounter" (patch released
over one year and half ago) makes the game incompatible with older
versions because it uses UDP instead of TCP.
This version is NOT vulnerable.

I have tested also the Linux beta version of "Serious Sam: the first
encounter" that uses UDP and in fact it is NOT vulnerable (instead the
Win32 version uses TCP and IS vulnerable).


#######################################################################

======
2) Bug
======


The bug is a remote crash or freeze of the server caused by a malformed
parameter in the data sent by the client.
The following is an example of the original data:

"\x1f\x00\x00\x00"
"\x40\xE1\xDE\x03\xFB\xCA\x2A\xBC\x83\x01\x00\x00\x07\x47\x41\x54"
"\x56\x10\x27\x00\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01"
"\x00\x00\x00\xA0\x0F\x00\x00\x64\x00\x00\x00"


The first parameter, 0x0000001f, probably is the size of the data that
follows it or something similar and if you modify it the server will
have some different "bad" effects.

For example values over 0x81000000 crash the server and other values
like 0xfffffff0 instead freeze it.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/ssboom.zip


#######################################################################

======
4) Fix
======


- "Serious Sam: the first encounter":
  No fix.
  I have tried to contact Croteam without success, then seems there is
  no longer support for the Serious Sam games.


- "Serious Sam: the second encounter":
  Simply use the 1.07 patch already available by long time.
  During my tests I have seen (and not only seen eh eh eh) a lot of
  people using the 1.05 version yet, so don't lost time and update this
  fantastic game!!!


- Other games based on the Serious Sam engine:
  I don't have and I have not tested other games (causes: no demo or
  demo doesn't support multiplayer or there were no servers online) so
  I'm not sure if they are vulnerables or not.


#######################################################################