Clients broadcast buffer overflow in Red Faction <= 1.20

[Luigi Auriemma <aluigi () altervista org>]

#######################################################################

                             Luigi Auriemma

Application:  Red Faction
              http://www.redfaction.com
Versions:     <= 1.20
Platforms:    Windows, MacOS
Bug:          broadcast client buffer overflow
Risk:         highly critical
Exploitation: remote and automatic, versus clients
Date:         01 Mar 2004
Author:       Luigi Auriemma
              e-mail: aluigi () altervista org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Red Faction is a very cool FPS game developed by Volition
(http://www.volition-inc.com).
The main and most famous feature of this game is the possibility to
destroy walls and other scenario's elements with bombs and rocket
launchers... very funny and relaxing.


#######################################################################

======
2) Bug
======


The problem is a broadcast client buffer overflow.
Each client entering in the multiplayer menu of the game first contacts
the master server to know what game servers are online and then asks
informations to eachone of them.
The reply of the servers contains a NULL terminated text string
identifying the server name, if this string is major or equal than 260
chars the client will be victim of a buffer overflow vulnerability
caused by the following memcpy() function (from 1.20 version):

:0047B2D8 F3A5                    rep movsd

The attacker on the (passive) server will have full control over any
client.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/rfcbof.zip


#######################################################################

======
4) Fix
======


No fix.
No replies from developers.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org