#######################################################################
Luigi Auriemma
Applications: games developed by SimBin Development Team
http://www.simbin.se
Versions: GTR - FIA GT Racing Game <= 1.5.0.0
http://www.gtr-game.com
GT Legends <= 1.1.0.0
http://www.gt-legends.com
GTR 2 <= 1.1
http://www.gtr-game.com
RACE - The WTCC Game <= 1.0 (0.6.3.0?)
http://www.race-game.org
Platforms: Windows
Bug: clients disconnection
Exploitation: remote, versus clients
Date: 21 Feb 2007
Author: Luigi Auriemma
e-mail: aluigi (at) autistici (dot) org [email concealed]
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Simbin is a well known software house specialized in the developing of
racing games deeply devopted to extreme simulation.
All their games are very recent, GTR was released in November 2004
while Race WTCC exactly two years later.
#######################################################################
======
2) Bug
======
The problem is very simple, an UDP packet of zero bytes (empty) sent to
the main port of the server (usually 48942 for Race WTCC and 34297 for
the other games) forces the disconnection of all the clients connected
to it.
The attacker needs only to send one packet (spoofing possible) and the
clients in the game will be immediately kicked with the message "Lost
connection with the Host".
Then they can re-join again... but can be re-kicked in the same way
too.
#######################################################################
===========
3) The Code
===========
- get udpsz from here:
http://aluigi.org/testz/udpsz.zip
- launch it versus the server:
udpsz 127.0.0.1 34297 0 for GTR, GTR2 and GT Legends
udpsz 127.0.0.1 48942 0 for Race WTCC
- check what happened to the clients connected to it
#######################################################################
======
4) Fix
======
No fix.
No reply received from the developers.
#######################################################################
---
Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org
