Lithtech Engine - Memory Corruption

# Original Advisory: http://aluigi.org/adv/fearless-adv.txt
#
#######################################################################

                             Luigi Auriemma

Application:  Lithtech engine
              http://www.lithtech.com
Games:        any game should be affected, refer to
              http://en.wikipedia.org/wiki/Lithtech#Lithtech_implementations
              those personally tested by me are:
                F.E.A.R.                                        <= 1.08
                F.E.A.R. 2 Project Origin                       <= 1.05
                  http://www.whatisfear.com
Platforms:    Windows and Mac
Bug:          memory corruption
Exploitation: remote, versus server
Date:         20 Jul 2010
Author:       Luigi Auriemma
              e-mail: [email protected]
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Lithtech is the well known game engine developed by Monolith and used
in various famous games like Alien vs Predator 2, No One Lives Forever
and the F.E.A.R. series.
Currently the first episode of F.E.A.R. is the most played online of
the games based on the Lithtech engine.


#######################################################################

======
2) Bug
======


I premise that I haven't performed a deep research on the vulnerability
and I have focused my tests mainly on F.E.A.R. although after a quick
test has been confirmed the same/similar problem on other games that
use protocol 2 of the Lithtech engine like No One Lives Forever 2.

Through a malformed packet is possible to corrupt the memory of the
game with effects that seem to suggest the possibility for an attacker
to do something more than the crashing of the server.
Indeed the problem affects some function pointers so it's not excluded
the possibility to have a certain control over them and the code flow
remotely.

No other technical details are available at the moment.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/fearless.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14424.zip (fearless.zip)

tuned to work with the F.E.A.R. series, so Project Origin included.


#######################################################################

======
4) Fix
======


No fix.


#######################################################################