Unreal engine updates and Battle Mages advisory

[Luigi Auriemma]

I have an update about the methods used to test the format string
vulnerability in the Unreal engine I reported yesterday.
I have solved a problem in the windows version of my proof-of-concept
unrfs-poc (now version 0.1.1):

http://aluigi.altervista.org/poc/unrfs-poc.zip


The following instead is a very fast and easy method to test the Unreal
engine based games without using external programs or complicated exploits.
I highly suggest users to use this quick method instead of the previous
proof-of-concept:

-----
Another method to test the vulnerability is the adding of %n after
"Class=" in the file system/user.ini

Example:

From:
Class=Engine.Pawn

To:
Class=%n%nEngine.Pawn

If the game is vulnerable it will crash when launched.
-----


The last news regards an advisory about a server freeze bug in the new game
Battle Mages:

http://aluigi.altervista.org/adv/battlemages-adv.txt


BYEZ


---
Luigi Auriemma
http://aluigi.altervista.org

[Todd Chapman]

Luigi,

After seeing some doubt expressed by users in the Unreal community, I
tried your INI file test this morning on multiple Unreal Tournament
products and just now on America's Army 2.0. I confirmed crashes for UT,
UT2003 demo, and AA. UT2004 demo ran fine. Results are detailed a little
more below.

One question: Do you see the remote code execution as a possibility or
did you actually accomplish executing code in your tests? I'm trying to
clarify the exact level of threat to some users and they tend to take it
more seriously when it can be presented as "verified to be exploitable
for practical use not just DoS".


Results:
Unreal Tournament v451: Crashed with a GPF. Errors noted in log as follows:
-----
ScriptLog: InitGame:
?Name=-TD-PintOStout?;Class=BotPack.TBoss?Class=%n%nBotPack. TMale2?team=1?skin=SoldierSkins.hkil?Face=SoldierS kins.Vector?Voice=BotPack.VoiceMaleTwo?OverrideCla ss=
ScriptLog: Base Mutator is CityIntro.Mutator1
Init: Initialized moving brush tracker for Level CityIntro.MyLevel
Log: Bound to UWeb.dll
Critical: UObject::SafeLoadError
Critical: UObject::GetPackageLinker
Critical: UObject::StaticLoadObject
Critical: (Core.Class .TMale2 NULL)
Critical: UObject::StaticLoadClass
Critical: ULevel::SpawnPlayActor
Critical: UGameEngine::Init
Critical: InitEngine
Exit: Executing UObject::StaticShutdownAfterError
Exit: Executing UWindowsClient::ShutdownAfterError
Log: DirectDraw End Mode
Exit: Exiting.
Uninitialized: Name subsystem shut down
Uninitialized: Log file closed, 03/11/04 08:35:07
-----

Current UT2003 Demo (build 2206): Simple shutdown during lauch with no
visual error message. Left the log file at home but believe it just stopped.

UT2004 Demo: Launched without issue

America's Army 2.0: Shutdown during launch similar to UT2003 Demo. Log
file just stopped in the middle of a line:
----
ScriptLog: FontNames[3]=AAFontMedium
Fonts[3]=Transient.InteractionMaster0.AAFontMedium0
ScriptLog: FontNames[4]=AAFontMedium
Fonts[4]=Transient.InteractionMaster0.AAFontMedium0
ScriptLog: GUIStyles::Initialize() - AALargeText
ScriptLog: Fon
----


--
Todd Chapman
Systems Architect
TChapman@leoninedev.com