Users login

Create an account »


Users login

Home » Hacking News » Bufferoverflow in 0verkill Server

Bufferoverflow in 0verkill Server

by Nikola Strahija on December 13th, 2002 Remote explotation of a buffer overflow within the 0verkill server source could allow a remote attacker to gain the privilages of whichever user the process is running as.


0verkill is a client-server 2d deathmatch-like game in ASCII art. It
supports free connecting/disconnecting during the game, and runs well on
modem lines. Graphics are in 16-color ASCII art with elaborate hero
animations. 0verkill features 4 different weapons, grenades, invisibility,
and armor. The package also contains reaperbot clients, a simple graphics
editor, and a level editor. The server portion of 0verkill listens on an
UDP port (6666 by default).


Remote explotation of a buffer overflow within the 0verkill server source
could allow a remote attacker to gain the privilages of whichever user the
process is running as. Since there are no authentication measures built
into the game, this problem can be considered to be PREAUTH*. This is a
very serious vulnerability and should be taken seriously.

The following is a snapshot of the exploit in action.

[email protected]:~$ ./0verkillflow -t 5 -h -o l -p 6666
Attacking host (Linux 2.4.20-grsec).
id; uname -a
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
Linux spender 2.4.20 #1 Sat Dec 7 13:44:54 EST 2002 i686 unknown

[email protected]:~$ su -
[email protected]:~# rm -rf /&


Remote attackers can use this exploit to gain unauthorized access to your
corporate network if you do not immediately upgrade to the latest version of
0verkill. We have seen evidence of this being exploited in the wild, and
suggest that ISS and Securityfocus increase the ARIS Threatcon to at least 7.

Most of our clients have probably already been compromised by this exploit of
ours, and those who were not running the daemon as root were probably later
rooted locally by bugs in **Abuse that the author refuses to patch.

Since this exploit exists in the wild, we will soon send our IDS signatures
to Max Vision and Martin Roesch so that they may update their IDS systems to
detect this version of the attack, and this exploit specifically. Please
keep in mind that these signatures will not be sufficient for other versions
of the exploit, and that you may need to upgrade your IDS to a better
mechanism that is capable of detecting more than specific versions of an


To detect whether or not you are running a vulnerable version of the 0verkill
server or not, we suggest that you take the md5sum of the binary. For example:

[email protected]:/usr/src/0verkill-0.16# md5sum server
0f210947eec2ead10e00069896d2f4bb server

If your server binary has the same checksum as our binary, here at iDefense
Labs, you are vulnerable to this attack and must immediately upgrade your
service to the latest version. We're currently attempting to devise a more
reliable method to verify whether or not an executable is vulnerable or not,
but our research scientists are at this time stumped.

The IDS experts from Sourcefire, ISS, and NFR are currently studying this
vulnerability and are developing exploits for it, so that they might understand
all possible methods of exploitation, and accordingly create the proper dynamic
rules to help you detect all variations of this bug being exploited, instead of
a single version which ultimately won't help anything. Once this has been done, you can replay your network traffic through your sensors and watch to see if this has been exploited on your network yet or not.


We have not been able to contact any of the developers for the software, and at this time there is no fix for the problem.


We have received information from Brian McWilliams which links MITRE to the
Al Quada terrorist network, and for this reason we will no longer participate
in any MITRE sponsored programs.


11/20/2002 Issue disclosed to iDEFENSE
12/08/2002 Maintainer, Brain ([email protected]),
and NetBSD Security Officer ([email protected])
12/09/2002 Contacted CERT ([email protected]) about the matter.
12/10/2002 Attempted to contact CERT again for assistance with contacting
the authors of 0verkill.
12/11/2002 iDEFENSE clients notified
12/12/2002 Coordinated public disclosure


GOBBLES ([email protected]) discovered this vulnerability.

*By PREAUTH, we mean pre-authentication.
**Please read our previous advisory on Abuse, which can be found here:

" Life without CERT is like the Chocolate Factory without Charlie :-( "
Version: Hush 2.2 (Java)
Note: This signature can be verified at


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »