####################################################################### Luigi Auriemma Application: Skulltag http://www.skulltag.com Versions: <= 0.97d-beta4.1 Platforms: Windows and Linux Bug: heap-overflow Exploitation: remote, versus server Date: 23 Aug 2007 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Skulltag is a well known and played Doom engine mainly based on Zdoom (but not open source as it) and focused on online gaming. ####################################################################### ====== 2) Bug ====== The game is vulnerable to a heap overflow located in the function which performs the huffman decompression of the incoming packets, allowing possible malicious code execution through a single UDP packet. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/skulltaghof.zip ####################################################################### ====== 4) Fix ====== No fix. Developers have not been contacted since one year ago the format string vulnerability I reported to them was handled as a normal bug and the patch was released some months after my advisory. #######################################################################