Star Wars Jedi Knight: Jedi Academy Buffer Overflow Vulnerability

TITLE: Star Wars Jedi Knight: Jedi Academy Buffer Overflow Vulnerability
CLASS: Boundary Condition Error
CVE: CAN-2005-0984

REMOTE: Yes
LOCAL: No
PUBLISHED: Apr 02 2005 12:00AM
UPDATE: Apr 02 2005 12:00AM
CREDIT: Discovered by Luigi Auriemma <aluigi@..>.
VULNERABLE:

LucasArts Star Wars Jedi Knight: Jedi Academy 1.0.11
NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

A buffer overflow is present in Jedi Academy that can be exploited remotely by client systems. The overflow is due to the use of the sprintf() function in a text visualization procedure, G_Printf(). The attacker can exploit this vulnerability to execute arbitrary code on the server.

Exploit

The advisory describing this vulnerability published by Luigi Auriemma outlined the following steps for exploitation:

- download the following file:
jamsgbof.cfg
- place it in the base folder of the game: GameData\base
- start a client and a server
- join the server
- go into the client console (shift + ~)
- type: /exec jamsgbof
- the server will crash with the return address overwritten with
0x61616161

Solution

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

References

References:

PhpLog

BNLug Benevento Linux Users Group