Full Disclosure mailing list archives
Heap overflow in Skulltag 0.97d-beta4.1
From: Luigi Auriemma <aluigi () autistici org>
Date: Fri, 24 Aug 2007 01:19:47 +0200
####################################################################### Luigi Auriemma Application: Skulltag http://www.skulltag.com Versions: <= 0.97d-beta4.1 Platforms: Windows and Linux Bug: heap-overflow Exploitation: remote, versus server Date: 23 Aug 2007 Author: Luigi Auriemma e-mail: aluigi () autistici org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Skulltag is a well known and played Doom engine mainly based on Zdoom (but not open source as it) and focused on online gaming. ####################################################################### ====== 2) Bug ====== The game is vulnerable to a heap overflow located in the function which performs the huffman decompression of the incoming packets, allowing possible malicious code execution through a single UDP packet. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/skulltaghof.zip ####################################################################### ====== 4) Fix ====== No fix. Developers have not been contacted since one year ago the format string vulnerability I reported to them was handled as a normal bug and the patch was released some months after my advisory. ####################################################################### --- Luigi Auriemma http://aluigi.org http://mirror.aluigi.org _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Heap overflow in Skulltag 0.97d-beta4.1 Luigi Auriemma (Aug 23)