Format string in F.E.A.R. 1.08 through PB

#######################################################################

                             Luigi Auriemma

Application:  F.E.A.R. (First Encounter Assault Recon)
              
http://www.whatisfear.com
Versions:     <= 1.08
Platforms:    Windows and Linux
Bug:          format string
Exploitation: remote, versus server with Punkbuster enabled
Date:         01 Oct 2007
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org

#######################################################################



1) Introduction
2) Bug

#######################################################################

1. Introduction

   ---

F.E.A.R. is the most recent FPS game developed by Monolith (http://www.lith.com).

#######################################################################

This bug is nothing new moreover considering that it's public from the far 2004 when this game was still a beta:

  http://aluigi.org/adv/lithfs-adv.txt

What changes this time is the type of exploitation and the derived advantages since now the attack is completely anonymous from outside the server using only one UDP packet.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

When Punkbuster is enabled on a server (true for many public servers) it visualizes the content of some incoming packets using the game's console.
The Punkbuster packets needed for forcing the visualization of a custom string in the console are PB_Y (YPG server) and PB_U (UCON), while in the past was ok to use PB_P too which has been recently made no longer verbose probably due to its abusing attempted by people for spamming servers (which is naturally still possible with the above packets).

As already said this is a bug in the Lithtech engine and NOT in Punkbuster which is used only as a "way" for exploiting it.

#######################################################################

http://aluigi.org/poc/fearfspb.zip

#######################################################################

No fix.
The bug has been never "really" patched although it's public from 3 years.

#######################################################################

---
Luigi Auriemma

http://aluigi.orghttp://forum.aluigi.orghttp://mirror.aluigi.org

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek