[NEWS] Star Wars Jedi Knight: Jedi Academy Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Star Wars Jedi Knight: Jedi Academy Buffer Overflow
------------------------------------------------------------------------


SUMMARY

 <http://www.ravensoft.com> Jedi Academy is "a first person shooter that 
uses the Quake 3 engine, it's developed by Raven Software".

A buffer overflow in the Star Wars Jedi Knight: Jedi Academy server allows 
a remote attacker to cause it execute arbitrary code. The buffer overflow 
is triggered by providing an arbitrarily long NICKNAME.

DETAILS

Vulnerable Systems:
 * Star Wars Jedi Knight: Jedi Academy version 1.011 and prior

The game is affected by a buffer-overflow in the visualization function 
called G_Printf(). This function uses a sprintf() with a local buffer of 
1024 bytes where it stores the text to display in the console so if an 
attacker sends a big message (through the commands say and tell for 
example) the server calls G_Printf() for visualizing a string like the 
following example:
  say: NICKNAME: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...aaaaaaaa\n

The result is that an attacker could execute malicious code on the victim 
server. The only limitation is that this is an in-game bug so the attacker 
must have access to the server, if it's protected by password he must know 
the keyword.

Exploit:
 - Download the following file:  
<http://aluigi.altervista.org/poc/jamsgbof.cfg> 
http://aluigi.altervista.org/poc/jamsgbof.cfg
 - Place it in the base folder of the game: GameData\base
 - Start a client and a server
 - Join the server
 - Go into the client console (shift + ~)
 - Type: /exec jamsgbof
 - The server will crash with the return address overwritten with 
0x61616161


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Luigi 
Auriemma.
The original article can be found at:  
<http://aluigi.altervista.org/adv/jamsgbof-adv.txt> 
http://aluigi.altervista.org/adv/jamsgbof-adv.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.