Multiple vulnerabilities in Live for Speed 0.5X10

Advisory Content :

#######################################################################

Luigi Auriemma

Application: Live for Speed
http://www.lfs.net
Versions: <= 0.5X10
Platforms: Windows
Bugs: A] nickname buffer-overflow
B] partial track buffer-overflow
C] NULL pointer access in internet/hidden S1/S2 servers
D] memcpy() NULL pointer in internet/hidden S1/S2 servers
Exploitation: remote, versus server
A] demo/S1/S2 in-game
B] demo/S1/S2 in-game
C] S1/S2 (internet/hidden)
D] S1/S2 (internet/hidden)
Date: 14 Aug 2007
Author: Luigi Auriemma
e-mail: aluigi (at) autistici (dot) org [email concealed]
web: aluigi.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Live for Speed (LFS) is one of the most known and cool car racing
simulators available since you can do a lot of things: races,
autocross, drifting, drag races and a parking too.

#######################################################################

=======
2) Bugs
=======

---------------------------
A] nickname buffer-overflow
---------------------------

A buffer-overflow vulnerability is located in the portion of code which
handles the client's nickname from packets with ID 3.
This packet must contain the following NULL terminated strings:

24 bytes for the nickname
8 bytes for the car's plate
16 bytes for other data
16 bytes for the helmet

For exploiting the bug it's enough to set a nickname longer than its
needed size overwriting the other fields after it in the packet.

--------------------------------
B] partial track buffer-overflow
--------------------------------

Another buffer-overflow is exploitable through the packets with ID 10
but this time doesn't seem possible to use it for executing remote
code because the return address is overwritten by a fixed string of the
server.

In short when the user requests a track which is not available on the
host, the server calls:

sprintf(buff, "%s is not enabled on this host", client_track);

using a destination buffer enough big to avoid the controlling of the
return address but not enough for avoiding a crash.

-------------------------------------------------------
C] NULL pointer access in internet/hidden S1/S2 servers
-------------------------------------------------------

The S1 and S2 servers which run in internet (so visible on the master
server) or hidden mode are vulnerable to a crash attack caused by the
access to a NULL pointer.
The problem is exploitable through a packet containing a byte 0x00 at
the data offset 23 of the pre-login packet with ID 3.
demo and LAN servers are not vulnerable.

---------------------------------------------------------
D] memcpy() NULL pointer in internet/hidden S1/S2 servers
---------------------------------------------------------

The S1 and S2 servers which run in internet (so visible on the master
server) or hidden mode are vulnerable to a crash attack caused by the
calling of memcpy() with a NULL source (in reality it's NULL + 12).
The problem seems caused by the absence of one or more needed strings
in the pre-login packet with ID 5.
demo and LAN servers are not vulnerable.

Resuming:
Both the bugs A and B are in-game so the attacker must have access to
the server like knowing its password if it's protected or being not
banned.
Bugs C and D instead work versus any server except demo and LAN servers
and are not in-game so any attacker can crash any server, password
protected too.

#######################################################################

===========
3) The Code
===========

with the following tool the bugs A and B can be tested only versus the
demo server:

http://aluigi.org/fakep/lfsfp.zip

#######################################################################

======
4) Fix
======

The only thing that the developers have been able to tell me is that
the bugs will be fixed in Patch Y (yes I have asked for a release date
but they don't know it)... that's really stupid since a quick fix was
the best choice moreover considering the auto-patching system of the
game.

#######################################################################

---
Luigi Auriemma
http://aluigi.org
http://mirror.aluigi.org

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Multiple vulnerabilities in Live for Speed 0.5X10