Sauerbraten多个远程漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195790 漏洞类型
发布时间 2006-03-09 更新时间 2006-03-10
CVE编号 CVE-2006-1102 CNNVD-ID CNNVD-200603-165
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://cxsecurity.com/issue/WLB-2006030045
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200603-165
|漏洞详情
Sauerbraten2006_02_28,当从Cube引擎上引用时,远程攻击者可以通过迫使服务器改到一个其名称包含".."序列和具有一定长度以防止加上".ogz"扩展名的地图(ogz)文件上,制造拒绝服务(用户退出)。
|漏洞EXP
#######################################################################

Luigi Auriemma

Application:  Cube engine
              http://www.cubeengine.com
Versions:     <= 2005_08_29
Platforms:    Windows, *nix, *BSD and MacOS
Bugs:         A] sgetstr() buffer-overflow
              B] invalid memory access
              C] clients crash through invalid map
Exploitation: remote, versus both server and clients
Date:         06 Mar 2006
Author:       Luigi Auriemma
              e-mail: aluigi (at) autistici (dot) org [email concealed]
              web:    http://aluigi.altervista.org

#######################################################################

1) Introduction
2) Bugs
3) The Code
4) Fix

#######################################################################

===============
1) Introduction
===============

Cube is an interesting open source game and engine developed by Wouter
van Oortmerssen (http://strlen.com).
It supports both LAN and Internet multiplayer through its master
server.

#######################################################################

=======
2) Bugs
=======

----------------------------
A] sgetstr() buffer-overflow
----------------------------

The game uses an unchecked function for reading the strings from the
incoming data.
The function is sgetstr() located in cube.h:

#define sgetstr() { char *t = text; do { *t = getint(p); } while(*t+
+); }

The problem, which affects both server and clients, is that this code
copies the input data over the text buffer of size MAXTRANS (5000 bytes)
allowing possible malicious code execution.

------------------------
B] invalid memory access
------------------------

sgetstr(), getint() and the instructions which call them don't check
the correct length of the input data.
In short is possible to force the server or the client to read over the
received data reaching unallocated zones of the memory and so crashing
immediately.
The biggest example in the Cube engine is the SV_EXT tag used in the
server where is read a 32 bits number from the input data and then is
performed a reading loop:

for(int n = getint(p); n; n--) getint(p);

------------------------------------
C] clients crash through invalid map
------------------------------------

In the Cube engine the players have the possibility to choose a
specific map on which playing, if there is only one player in the
server the map is changed immediately otherwise will be voted.
When a client tries to load an invalid map file it exits immediately
showing the "while reading map: header malformatted" error.
When the map is choosed all the clients add a .ogz extension to the
mapname received from the server and load the file.
The max size of the mapname is 260 bytes and the function which loads
the file uses a secure sprintf() which truncates the input mapname
(.ogz included) when the limit is reached.
Then the loading of the map is not sanitized versus possible directory
traversal exploitations so if an attacker (a player) specifies a
mapname of about 260 bytes he can force any client which will join the
server (due to the voting problem explained previously which limits the
exploitation of this bug) to load any file which is not a valid map and
so they will exit immediately.
As already said the exploitation happens with any new client which
joins the server since the new mapname will remain active in the server
for all the current match.

#######################################################################

===========
3) The Code
===========

http://aluigi.altervista.org/poc/evilcube.zip

#######################################################################

======
4) Fix
======

No fix.
The author says that the engine is no longer supported.

#######################################################################

--- 
Luigi Auriemma
http://aluigi.altervista.org
|参考资料

来源:BID
名称:16986
链接:http://www.securityfocus.com/bid/16986
来源:BUGTRAQ
名称:20060306MultiplevulnerabilitiesinCubeengine2005_08_29
链接:http://www.securityfocus.com/archive/1/archive/1/426867/100/0/threaded
来源:BUGTRAQ
名称:20060306MultiplevulnerabilitiesinSauerbratenengine2006_02_28
链接:http://www.securityfocus.com/archive/1/archive/1/426865/100/0/threaded
来源:VUPEN
名称:ADV-2006-0848
链接:http://www.frsirt.com/english/advisories/2006/0848
来源:VUPEN
名称:ADV-2006-0847
链接:http://www.frsirt.com/english/advisories/2006/0847
来源:SECUNIA
名称:19111
链接:http://secunia.com/advisories/19111
来源:SECUNIA
名称:19110
链接:http://secunia.com/advisories/19110
来源:MISC
链接:http://aluigi.altervista.org/adv/evilcube-adv.txt
来源:XF
名称:sauerbraten-sprintf-dos(25086)
链接:http://xforce.iss.net/xforce/xfdb/25086
来源:GENTOO
名称:GLSA-200603-10
链接:http://www.gentoo.org/security/en/glsa/glsa-200603-10.xml
来源:SREASON
名称:548
链接:http://securityreason.com/securityalert/548
来源:SECUNIA
名称:19199
链接:http://secunia.com/advisories/19199