Buffer-overflow in the Asura engine

2007.08.26
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-Other


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

####################################################################### Luigi Auriemma Application: Asura engine (network SDK) http://www.rebellion.co.uk Games: Rogue Trooper <= 1.0 Prism: Guard Shield <= 1.1.1.0 ...possibly others... Platforms: Windows Bug: challenge buffer-overflow Exploitation: remote, versus server (in-game) Date: 22 Aug 2007 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Asura is a game engine written by Rebellion and used in their games. Rogue Trooper and Prism are the only two games (as far as I know) which use the new network protocol which leads to the vulnerability reported in this advisory, the older games were based on DirectPlay (Judge Dredd) and Gamespy SDK (Sniper Elite). ####################################################################### ====== 2) Bug ====== A buffer-overflow vulnerability is located in the function which handles the 0xf007 packet used for the challenge B query. In this function the data passed by the client is copied (without checks on its length) to a stack buffer of 256 bytes used for sending the data back to the client, something similar to a ping. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/asurabof.zip ####################################################################### ====== 4) Fix ====== No fix. Rebellion is one of those vendors which have never replied to my past mails. ####################################################################### --- Luigi Auriemma http://aluigi.org http://mirror.aluigi.org


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top