Possible code execution in Kaillera 0.86

2006-07-0800:00:00

vulners.com

JSON

#######################################################################

                         Luigi Auriemma

Application: Kaillera
http://www.kaillera.com
Versions: <= 0.86
Platforms: Windows, Linux and FreeBSD
Bug: buffer-overflow
Exploitation: remote, versus server
Date: 06 Jul 2006
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org

#######################################################################

1) Introduction
2) Bug
3) The Code
4) Fix

#######################################################################

===============
1) Introduction

Kaillera is a middleware software for implementing network capabilities
in emulators like MAME, MameLang32+, Bliss, NESten, Jnes, Nemu64,
Modeler, Gens, WinUAE, PCAE, Kawaks and possibly others.
Although the latest server's version has been released over 4 years ago
it's still widely used as demonstrated by the online servers lists.

#######################################################################

======
2) Bug

The handling of almost all the Kaillera messages is made through the
reading of the first NULL terminated string and the subsequent reading
of the remaining data in the message (its content will be parsed in
another step).
For these operations Kaillera uses a static buffer of 32 bytes and a
data buffer which is reallocated everytime that the size of the client
message is bigger than the actual allocated size of the buffer.
The instructions which handle these types of messages start from about
offset 004019f1 of the Windows server 0.86:

which can be traduced (plus or less) in C like the following code:

static char nick[32],
            *data;
...
int     nick_size,
        data_size;

for&#40;nick_size = 0; *client_msg; nick_size++, client_msg++&#41; {
    nick[nick_size] = *client_msg;
}
nick[nick_size] = 0;
client_msg++;
data_size = &#40;client_msg_size - nick_size&#41; - 2;
data      = 004016f0&#40;data_size&#41;;    // realloc data if needed
memcpy&#40;data, client_msg, data_size&#41;;

...

004016f0&#40;int size&#41; {
    if&#40;size &lt;= data_alloc_size&#41; return;
    do {
        data_alloc_size &lt;&lt;= 1;
    } while&#40;size &gt; data_alloc_size&#41;;
    data = realloc&#40;data, data_alloc_size&#41;;
}

If an attacker uses a nickname longer than 32 bytes he can overwrite
the address of the data buffer and the value in which is stored its
actual allocated size, the following scheme shows that piece of memory:

ooooooooooooooooooooooooooooooooXXXXYYYY
| | |
| | amount of data currently allocated
| pointer to the data buffer
static buffer of 32 bytes

With the overwriting of YYYY we can bypass the first check made by the
function at offset 004016f0 which does a realloc of the buffer if
needed since we control the actual allocated size and then we can
decide where copying the rest of our message in the memory of the
server since the address of data XXXX is controlled by us too.
That leads to the possibility of executing malicious code.

#######################################################################