Multiple vulnerabilities in Alien Arena 2006 GE 5.00

[Luigi Auriemma <aluigi@xxxxxxxxxxxxx>]

#######################################################################

                             Luigi Auriemma

Application:  Alien Arena 2006 Gold Edition
              http://red.planetarena.org
Versions:     <= 5.00
Platforms:    Windows and Linux
Bugs:         A] safe_cprintf server format string
              B] Cmd_Say_f server buffer-overflow
              C] Com_sprintf crash
Exploitation: A] remote, versus server (in-game)
              B] remote, versus server (in-game)
              C] remote, versus clients and server (in-game)
Date:         07 Mar 2006
Author:       Luigi Auriemma
              e-mail: aluigi@xxxxxxxxxxxxx
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Alien Arena 2006 GE is the latest release of the CodeRED series, an
open source game developed on an enhanced version (CRX engine) of the
GPLed Quake II engine.
The game supports both LAN and Internet multiplayer.


#######################################################################

=======
2) Bugs
=======


All the bugs need to be exploited in-game so the attacker's IP must be
not banned and he must know the right keyword if the server is
protected by password.
I have found no ways to exploit them "externally".


------------------------------------
A] safe_cprintf server format string
------------------------------------

The safe_cprintf() function used by the server for sending messages to
the clients is affected by a format string vulnerability which could
allow the execution of malicious code.
After having built the output string the function passes it as format
argument (yes it's just like a double sprintf) to gi.cprintf() ->
"void PF_cprintf (edict_t *ent, int level, char *fmt, ...)".

>From games/acesrc/acebot_cmds.c:
void safe_cprintf (edict_t *ent, int printlevel, char *fmt, ...)
{
        char    bigbuffer[0x10000];
        va_list         argptr;
        int len;

        if (ent && (!ent->inuse || ent->is_bot))
                return;

        va_start (argptr,fmt);
        len = vsprintf (bigbuffer,fmt,argptr);
        va_end (argptr);

        gi.cprintf(ent, printlevel, bigbuffer);
        
}


-----------------------------------
B] Cmd_Say_f server buffer-overflow
-----------------------------------

The function Cmd_Say_f is used by the server for handling the text
messages received from the clients.
Cmd_Say_f uses a buffer of 2048 bytes in which puts the nickname of the
player who has sent the message using the secure (enough secure)
Com_sprintf() function followed by strcat() for appending the received
message.
These instructions allow an attacker to exploit the resulted
buffer-overflow for executing malicious code.

>From source/game/g_cmds.c:
void Cmd_Say_f (edict_t *ent, qboolean team, qboolean arg0)
{
        int             i, j;
        edict_t *other;
        char    *p;
        char    text[2048];
        gclient_t *cl;

        if (gi.argc () < 2 && !arg0)
                return;

        if ((!((int)(dmflags->value) & (DF_MODELTEAMS | DF_SKINTEAMS)))
|| (!ctf->value)) team = false;

        if (team)
                Com_sprintf (text, sizeof(text), "(%s): ",
ent->client->pers.netname); else
                Com_sprintf (text, sizeof(text), "%s: ",
ent->client->pers.netname);

        if (arg0)
        {
                strcat (text, gi.argv(0));
                strcat (text, " ");
                strcat (text, gi.args());
        }
        else
        {
                p = gi.args();

                if (*p == '"')
                {
                        p++;
                        p[strlen(p)-1] = 0;
                }
                strcat(text, p);
        }
    ...


--------------------
C] Com_sprintf crash
--------------------

The Com_sprintf() function is a custom snprintf() replacement widely
used in the code.
The only problem of this function (usually bigbuffer is enough big so
doesn't represent a risk) is caused by the final strncpy() call which
is not followed by an instruction for delimiting dest with a NULL byte.
Often, depending by the system/compiler, this lack leads to a crash.
In my tests I were able to crash the precompiled Windows clients
without problems through a skin of about 110 chars (MAX_OSPATH is 128).
In fact one of the best ways for exploiting this bug is just using a
player with a long skin, weapon or model name so any client which is
inside or will join the server while the attacker is playing will be
crashed immediately.
In this case we can watch the exploitation in the function
CL_LoadClientinfo() located in client/cl_parse.c.

>From source/game/q_shared.c:
void Com_sprintf (char *dest, int size, char *fmt, ...)
{
        int             len;
        va_list         argptr;
        char    bigbuffer[0x10000];

        va_start (argptr,fmt);
        len = vsprintf (bigbuffer,fmt,argptr);
        va_end (argptr);
        if (len >= size)
                Com_Printf ("Com_sprintf: overflow of %i in %i\n", len,
size); strncpy (dest, bigbuffer, size-1);
}


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/aa2k6x.zip


#######################################################################

======
4) Fix
======


No fix.
The developers will release a patch the next months.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org