Remote server crash in Team Factor <= 1.25
#######################################################################
Luigi Auriemma
Application: Team Factor (aka US Special Forces)
http://www.teamfactor.co.uk/
http://ms7fx.iccc.cz/teamfactor/
Versions: <= 1.25
(note: 1.25 and 1.25m uses the same vulnerable exe)
Platforms: Windows and Linux
Bug: reading of unallocated memory (crash)
Risk: high
Exploitation: remote, versus server
Date: 20 Feb 2004
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxxx
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
>From developers'site:
"Team Factor is a stand-alone multi-player action game designed with
team play in mind. The games mission, environment and objective is
inspired by the 'shadow' military operations - whether real or fiction
style."
#######################################################################
======
2) Bug
======
At offset 12 of each packet there is a 16bit value used to specify the
size of the data block that follows it.
This value is read as a signed short so if we use a negative value the
game will read unallocated memory (memcpy() instruction) and will
crash immediately.
The following are the instructions that cause the crash in the Win32
1.25 version:
:00530D23 0FBF6C240E movsx ebp, word ptr [esp+0E]
...
:00530D6B F3A5 repz movsd
:00530D23 16bit value read as signed short, movsx
:00530D6B copying of the data block into the new buffer, memcpy()
#######################################################################
===========
3) The Code
===========
http://aluigi.altervista.org/poc/tfboom.zip
#######################################################################
======
4) Fix
======
No fix.
Developers have not answered to my mails.
Fortunally fixing the problem is very simple in fact we must only
manage the 16bit value as an UNsigned short instead of a signed short:
from :00530D23 0FBF6C240E movsx ebp, word ptr [esp+0E]
to :00530D23 0FB76C240E movzx ebp, word ptr [esp+0E]
My unofficial patch for the Win32 version 1.25/m is available here:
http://aluigi.altervista.org/patches/tfboomw125.zip
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org