Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

In-game cl_guid crash in Soldier of Fortune II 1.03
From: Luigi Auriemma <aluigi () autistici org>
Date: Thu, 24 Feb 2005 19:17:03 +0000


#######################################################################

                             Luigi Auriemma

Application:  Soldier of Fortune II
              http://sof2.ravensoft.com
Versions:     <= 1.03 gold
Platforms:    Windows, Linux and MacOS
Bug:          crash caused by invalid memory pointer
Exploitation: remote, versus server (partially in-game)
Date:         24 Feb 2005
Author:       Luigi Auriemma
              e-mail: aluigi () autistici org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Soldier of Fortune II is a widely played FPS game developed by Raven
Software (http://www.ravensoft.com) and released in May 2002.


#######################################################################

======
2) Bug
======


The problem is a crash of the server caused by the access to a wrong
zone of the memory that happens after the handling of a big cl_guid
value passed by the client.

This is a partial in-game bug in fact the attacker must have access to
the server (so if his IP has been banned he cannot access) but he can
attack also servers protected by password without knowing the right
keyword.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/sof2guidboom.zip


#######################################################################

======
4) Fix
======


No fix.
The game is still "officially" unpatched from months so it can be
declared no longer supported.

I have been able to create a work-around only for the Windows version
to check the length of the cl_guid value and reject the clients that
send a value bigger than 64 bytes (the max size of the cl_guid buffer):

  http://aluigi.altervista.org/patches/sof2-103-guidfix.zip


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • In-game cl_guid crash in Soldier of Fortune II 1.03 Luigi Auriemma (Feb 24)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]