[NEWS] OpenBOR Multiple Format String

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  OpenBOR Multiple Format String
------------------------------------------------------------------------


SUMMARY

Beats of Rage (BOR) is a very nice open source beat'em up engine developed 
by  <http://www.senileteam.com> Senile Team and inspired by games like 
"Streets of Rage" and "the King of Fighters". It works on many platforms 
and supports mods:
 <http://borrevolution.vg-network.com> http://borrevolution.vg-network.com
 <http://www.borhosting.com> http://www.borhosting.com

Some format string vulnerabilities exist in BOR which can be exploited 
through malicious mod files.

DETAILS

The following are the pieces of code containing the bugs, anyway the most 
used functions are just shutdown (used to kill the game at its end or when 
an error is occurred) and update (for showing the text on the screen 
through the font_printf function):

void shutdown(char *msg, ...){
    static char buf[2048];
    va_list arglist;
    
    va_start(arglist, msg);
    vsprintf(buf, msg, arglist);
    va_end(arglist);

    ...

    printf("Done.\n\n\n\n");
    printf(buf);

    exit(0);
}

From predrawstatus():

                font_printf(21+xo, savedata.windowpos+19, 0, 
player[i].opponent->name);
        ...
        else if(player[i].joining && player[i].model){
            font_printf(21+xo, savedata.windowpos+2, 0, 
player[i].model->name);
        ...

From update():

        font_printf(0,230, 0, debug_msg);

From choose_difficulty:

            if(savedata.times_completed >= ifcomplete[i]) 
font_printf(120,160+i*10, (selector==i), set_names[i]);


Take an existing mod and:
- add the following line in data/scenes/intro.txt:
    music %08x.%08x.%08x.%08x 0

- add the following line in data/easy/1aeasy.txt:
    background %08x.%08x.%08x.%08x

The first operation exploits the format string in the update function when 
the game starts and the intro is automatically launched. The second one 
instead exploits the bug located in the shutdown function when the Easy 
level is selected and the character is chosen.

For extracting and rebuilding the PAK files is possible to use the 
following tool:
  <http://aluigi.org/papers/borpak.zip> 
http://aluigi.org/papers/borpak.zip

Fix:
No fix.
BOR is no longer supported while OpenBOR yes but I have received no 
replies from its developers.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Luigi 
Auriemma.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.