Remote server crash in Team Factor <= 1.25

2004-02-2400:00:00

vulners.com

JSON

#######################################################################

                         Luigi Auriemma

Application: Team Factor (aka US Special Forces)
http://www.teamfactor.co.uk/
http://ms7fx.iccc.cz/teamfactor/
Versions: <= 1.25
(note: 1.25 and 1.25m uses the same vulnerable exe)
Platforms: Windows and Linux
Bug: reading of unallocated memory (crash)
Risk: high
Exploitation: remote, versus server
Date: 20 Feb 2004
Author: Luigi Auriemma
e-mail: [email protected]
web: http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

>From developers'site:

"Team Factor is a stand-alone multi-player action game designed with
team play in mind. The games mission, environment and objective is
inspired by the 'shadow' military operations - whether real or fiction
style."

#######################################################################

======
2) Bug

At offset 12 of each packet there is a 16bit value used to specify the
size of the data block that follows it.
This value is read as a signed short so if we use a negative value the
game will read unallocated memory (memcpy() instruction) and will
crash immediately.
The following are the instructions that cause the crash in the Win32
1.25 version:

:00530D23 0FBF6C240E movsx ebp, word ptr [esp+0E]
…
:00530D6B F3A5 repz movsd

:00530D23 16bit value read as signed short, movsx
:00530D6B copying of the data block into the new buffer, memcpy()

#######################################################################