In-game cl_guid crash in Soldier of Fortune II 1.03
#######################################################################
Luigi Auriemma
Application: Soldier of Fortune II
http://sof2.ravensoft.com
Versions: <= 1.03 gold
Platforms: Windows, Linux and MacOS
Bug: crash caused by invalid memory pointer
Exploitation: remote, versus server (partially in-game)
Date: 24 Feb 2005
Author: Luigi Auriemma
e-mail: aluigi@xxxxxxxxxxxxx
web: http://aluigi.altervista.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Soldier of Fortune II is a widely played FPS game developed by Raven
Software (http://www.ravensoft.com) and released in May 2002.
#######################################################################
======
2) Bug
======
The problem is a crash of the server caused by the access to a wrong
zone of the memory that happens after the handling of a big cl_guid
value passed by the client.
This is a partial in-game bug in fact the attacker must have access to
the server (so if his IP has been banned he cannot access) but he can
attack also servers protected by password without knowing the right
keyword.
#######################################################################
===========
3) The Code
===========
http://aluigi.altervista.org/poc/sof2guidboom.zip
#######################################################################
======
4) Fix
======
No fix.
The game is still "officially" unpatched from months so it can be
declared no longer supported.
I have been able to create a work-around only for the Windows version
to check the length of the cl_guid value and reject the clients that
send a value bigger than 64 bytes (the max size of the cl_guid buffer):
http://aluigi.altervista.org/patches/sof2-103-guidfix.zip
#######################################################################
---
Luigi Auriemma
http://aluigi.altervista.org