Application: Pure Faction http://www.purefaction.org Versions: <= 3.0c Platforms: Windows Bug: server buffer overflow Risk: highly critical Exploitation: remote and automatic (requires attacker to have joined server) Date: 13 Mar 2015 Author: soulsgetnothing e-mail: soulsgetnothing (at) hotmail (dot) com [email concealed] web: none * Pure Faction is an unofficial third-party patch for Red Faction, an FPS game developed by Volition. (http://www.volition-inc.com) * After a client joins a server, a null-terminated text string can be sent with in-game chat, however when the text is bigger than 519 bytes, the return address is overwritten via stack overflow. Clients are not affected. The instruction that does this is in 3.0c is: .text:10013A18 rep movsd The attacker will have full control over any server that he can join. * No fix. Developers have been contacted, though they do not seem concerned with making a fix.
