|
|
Half-Life StatsMe插件CMD_ARGV存在缓冲区溢出漏洞
发布时间：2003-01-10
更新时间：2003-01-10
严重程度：中
威胁程度：远程拒绝服务
错误类型：边界检查错误
利用方式：服务器模式
BUGTRAQ ID：6575
受影响系统StatsMe StatsMe 2.6.9
+ Valve Software Half-Life Dedicated Server 3.1 .0.4 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.5 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.6 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.7 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.8 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.9 Linux
+ Valve Software Half-Life Dedicated Server 4.1 .0.4 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.6 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.7 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.8 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.9 Win32
+ Valve Software Half-Life Dedicated Server 4.1.1 .0 Win32
StatsMe StatsMe 2.6.16 Beta
+ Valve Software Half-Life Dedicated Server 3.1 .0.4 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.5 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.6 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.7 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.8 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.9 Linux
+ Valve Software Half-Life Dedicated Server 4.1 .0.4 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.6 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.7 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.8 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.9 Win32
+ Valve Software Half-Life Dedicated Server 4.1.1 .0 Win32
StatsMe StatsMe 2.6.17 Beta UNSTABLE
+ Valve Software Half-Life Dedicated Server 3.1 .0.4 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.5 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.6 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.7 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.8 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.9 Linux
+ Valve Software Half-Life Dedicated Server 4.1 .0.4 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.6 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.7 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.8 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.9 Win32
+ Valve Software Half-Life Dedicated Server 4.1.1 .0 Win32
StatsMe StatsMe 2.6.19 Beta
+ Valve Software Half-Life Dedicated Server 3.1 .0.4 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.5 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.6 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.7 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.8 Linux
+ Valve Software Half-Life Dedicated Server 3.1 .0.9 Linux
+ Valve Software Half-Life Dedicated Server 4.1 .0.4 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.6 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.7 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.8 Win32
+ Valve Software Half-Life Dedicated Server 4.1 .0.9 Win32
+ Valve Software Half-Life Dedicated Server 4.1.1 .0 Win32 详细描述
"statsme"[1]插件用于"半条命"游戏服务器。
statsme_cmd.cpp文件中存在如下代码：
105 char event_name[32];
106 char event_regid[32]; event_regid[0]=0;
107 char event_mode = '';
108 sscanf(CMD_ARGV(1),"%s %s %c",event_name,event_regid,&event_mode);
CMD_ARGV由服务器提供，但sscanf没有对提交的参数做正确边界检查，因此超过的数据可以覆盖内存任意内容，存在执行任意代码可能。
测试代码
尚无
解决方案
尚无
相关信息
VOID.AT Security <crew@void.at>
参考：http://online.securityfocus.com/archive/1/306320
|
