#######################################################################

                             Luigi Auriemma

Application:  IGI 2: Covert Strike
              http://www.igi2-game.com
Versions:     <= 1.3
Platforms:    Windows, Linux
Bug:          format string bug
Exploitation: remote, versus server
Date:         05 Apr 2004
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


IGI 2 is a tactical stealth-based FPS game developed by Innerloop
(http://www.innerloop.com) and published by Codemasters
(http://www.codemasters.com).
It has been released in February 2003.


#######################################################################

======
2) Bug
======


The IGI 2 server is affected by a format string bug in the logging
function of the RCON commands.
FYI, RCON commands are used by admins to administer their servers
remotely. This function exists in both dedicated and normal servers and
cannot be disabled.

A practical example of the bug "in action" is the following:

- Attacker sends: /hello-%08x.%08x.%08x.%08x
- Server logs:    [17:17:28] Consoled: 'hello-082aeefc.00000131.0061b64c.00000011' run from 192.168.0.3:32768

Update:
The bug is caused by the logging function NetManager_LogMessage which
takes the text to dump, adds a timestamp (using snprintf) and then
passes the whole string to the function File_printf without the needed
format argument (%s).


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/igi2fs.zip


#######################################################################

======
4) Fix
======


No fix.
Developers have not replied to my mails.

Update:

  http://aluigi.org/patches/igi2fsfix.lpatch
  http://aluigi.org/patches/igi2fsfix_linux.lpatch


#######################################################################