####################################################################### Luigi Auriemma Application: Live for Speed http://www.lfs.net Versions: <= 0.5X10 Platforms: Windows Bug: client buffer-overflow during skins handling Exploitation: remote, versus clients (the attacker can be a malicious client or the same server) Date: 13 Oct 2007 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Live for Speed (LFS) is one of the most known and cool car racing simulators available and allows to do a lot of things: races, autocross, drifting, drag races, demolition derby, knock out and more. ####################################################################### ====== 2) Bug ====== Live for Speed allows the players to use different skins for their cars, which can be those available by default or just new skins in DDS format created by the same users. When a player, after having joined the server, decides to enter on the track, a packet with all the informations about his car (like setup, colors and skin) is sent to the server which forwards some of these data to all the other connected clients. The field which contains the name of the skin in use by the player is a field of 16 bytes which is read by the clients and concatenated to the name of his car for the subsequent loading of the needed DDS file from the local skins folders. The operation is made without the proper checks resulting in a stack buffer-overflow. So, in short, any client which can join a server and can race on it (not as spectator) can also be able to exploit this vulnerability for crashing or possibly executing malicious code (the maximum number of allowed chars is 48) on all the clients connected to the server, except himself. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/lfscbof.zip ####################################################################### ====== 4) Fix ====== No fix. Developers have not been contacted since still exist (not patched yet) other buffer overflow vulnerabilities which affect the clients locally found by my friend n00b and reported to them at the end of July. ####################################################################### --- Luigi Auriemma http://aluigi.org http://forum.aluigi.org http://mirror.aluigi.org