|
Brought to you by:
Suppliers of:
|
|
|
| |
BZFlag is "a great and well known open source multiplayer tank game".
BZFlag server can be caused to crash by sending it an undelimited string, which it in turn badly handles. |
| |
Credit:
The information has been provided by Luigi Auriemma.
The original article can be found at: http://aluigi.altervista.org
|
| |
Vulnerable Systems:
* BZFlag version 2.0.4 and prior
The callsigns used by the clients are not checked or re-delimited by the server so is possible for a client to pass a callsign with no NULL bytes at its end causing problems (crash) to the server during the handling of this string.
On both Linux and Windows for x86 (using the precompiled packages) the server crash reached without problems but is possible that in some configurations the crash could happen after many tries or also never, depending by how the memory is handled on that platform.
The bug can be exploited also versus password protected servers without knowing the right keyword.
Proof of Concept:
http://aluigi.altervista.org/poc/bzflagboom.zip
Fix:
As written in the "Author" field the CVS version has been already patched from over two months.
|
|
|
|
|
