Luigi Auriemma

aluigi.org (ARCHIVE-ONLY FORUM!)
It is currently 19 Jul 2012 11:24

All times are UTC [ DST ]





Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 1 post ] 
Author Message
 Post subject: Stack overflow in gpbikes/wrs/kartracingpro
PostPosted: 15 Dec 2010 19:09 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
maybe this deserves an advisory but for the moment I post it here.

if you don't know the games in the title the following are their homepages:
http://www.gp-bikes.com
http://www.worldracingseries.net
http://www.kartracing-pro.com

GP Bikes is really very good so take a look at it if you like racing games.

The games use all the same engine and they encrypt all the UDP packets
with blowfish (bf_ecb) using the key "fe7epraruWRa7reV".

This engine is vulnerable to an 8 bytes stack overflow because the
buffer is 1400 bytes long but the UDP packet received from the network
is 1408 bytes.
The overflow happens immediately after the decryption of the content.

Proof-of-concept:
nc SERVER PORT -u < piboso_1.dat

Note that Kart Racing Pro is compiled with the exception handler so there
is no code execution, only a crash.


Attachments:
File comment: proof-of-concept
piboso_1.zip [290 Bytes]
Downloaded 51 times
Top
 Profile  
 
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 1 post ] 

All times are UTC [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for: