####################################################################### Luigi Auriemma Application: gMotor2 engine Games: F1 Challenge 99-02, rFactor, GT Legends, GTR, GTR 2, RACE, Race 07, BMW M3 Challenge, ARCA Sim Racing and possibly others Platforms: Windows Bugs: various vulnerabilities including crashes, silent denial of service and possible code execution Exploitation: remote, versus server Date: 19 Sep 2007 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== gMotor2 is a game engine developed by Image Space Incorporated (ISI) and used in many known and played racing games mainly developed by the same ISI and moreover by Simbin. ####################################################################### ======= 2) Bugs ======= This advisory is only a generic reference to the bugs I found and released publicly one month ago in rFactor which use just the same engine of these other games: http://aluigi.org/adv/rfactorx-adv.txt Note that not all the games are affected by these bugs, some are vulnerable only to some of them, some have different effects and seems that only one is not vulnerable at all (F1 99-02), anyway I have NOT performed further and specific research on them. The only new thing I have made from the rFactor advisory is the proof-of-concept below since the header of the network data blocks and the default ports change in these games. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/gmotor2.zip if the above fails try the following: http://aluigi.org/poc/rfactorx.zip ####################################################################### ====== 4) Fix ====== Image Space Incorporated is already aware of these vulnerabilities since I reported to them almost two months ago. UPDATE 25 Sep 2007 A patch for rFactor (seems unofficial) has been released so probably the other games will be hopefully update soon too. #######################################################################