Gamespy's CDKey validation toolkit is an SDK for games developers which enables them to easily implement online management of users and cd-key validation.
The in-game CD-Key validation toolkit is prone to a buffer overflow under certain conditions outlined in the following advisory. This might lead to remote code execution on the target server.
Credit:
The information has been provided by Luigi Auriemma.
Vulnerable Systems:
* Any game which uses the SDK version prior to 19th November 2004
Immune Systems:
* Games with an updated Gamespy SDK from 19th Nov. onward
The problem begins by an overly long reply sent by the game client to the game server. Typically there is no bounds checking on the returned client string and hence developers must place such a check themselves in order for their game not to be vulnerable. However, most games do not and just use the toolkit blindly.
The string is passed to an sprintf() call in preparation of a query for validating the CD-Key:
query_length = sprintf(
query,
"\\auth\\\\pid\\%d\\ch\\%s\\resp\\%s\\ip\\%d\\skey\\%d",
pid, // product ID of the game
ch, // server challenge
resp, // client response <-- the cause of the bug!
ip, // client IP address
skey); // number to track the query
The problem with the sprintf() call is that it allows for an arbitrary string length to be inserted in to the query. This might lead to overwriting of memory in such a manner that paves the way to remote code execution. The query is even XORed with the word "gamespy" in order to somehow obfuscate the format of the buffer. This countermeasure is of course simple and will fool a person looking at the raw data directly.
The vulnerability is limited due to the following factors:
* Since this bug is an in-game bug while building a query for CD-Key validation, the attacker must be a legitimate online user connected to the server.
* The attacker must understand the game's online protocol in order to send the malformed reply which will trigger the buffer overflow. This is perhaps not always trivial and might require the use of a debugger.
* If the developers of the game added special bounds checking code on the user string, thus protecting the toolkit, the buffer overflow would not be exploitable.
Proof Of Concept Note: The PoC requires additional headers and source files in order to compile. Only the main code is listed below. For the rest, refer to the link.
/*
by Luigi Auriemma - http://aluigi.altervista.org/poc/goregsbof.zip
if(timeout(sd) < 0) {
fputs("\nAlert: socket timeout, no replies received. Probably the server doesn't support the Gamespy query protocol or the port is wrong\n\n", stdout);
close(sd);
return;
}
