Hello, there is a new spam and crash exploit out there, we have seen it today on our CS:S server. What happend? A player connected and was able to send some spam messages which looked like they came from the server console, the players name is "h 4 x" in the following log. It seems the messages where spammed during the connection, so I suppose he used a proxy to send malformed packets during connection. After his spam, he connected again and crashed the server.
Here the console spam: L 11/15/2009 - 17:22:38: "h 4 x<552><STEAM_ID_PENDING><>" connected, address "87.122.42.104:27005" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "OWNED" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Wollt ihr dieses Script kaufen?" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Dann added ruhsi643 in Steam" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "HACKED" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "OWNED" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Wollt ihr dieses Script kaufen?" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "Dann added ruhsi643 in Steam" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "HACKED" L 11/15/2009 - 17:22:38: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr dieses Script kaufen?" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added ruhsi643 in Steam" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "HACKED" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "h 4 x<552><STEAM_0:0:17742854><>" STEAM USERID validated L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr dieses Script kaufen?" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added ruhsi643 in Steam" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "HACKED" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr dieses Script kaufen?" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added ruhsi643 in Steam" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "HACKED" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "OWNED" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "SPAM" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Wollt ihr dieses Script kaufen?" L 11/15/2009 - 17:22:39: "Console<0><Console><Console>" say "Dann added ruhsi643 in Steam" L 11/15/2009 - 17:22:40: "h 4 x<552><STEAM_0:0:17742854><>" disconnected (reason "Disconnect by user.") The last log line is: L 11/15/2009 - 17:27:00: "CRASHED BY ruhsi643 ADDET ruhsi<557><STEAM_ID_PENDING><>" connected, address "87.122.42.104:27005" After this line, the server crashed. This is the last line, because we run our server with logflush. Best regards Ronny Schedel _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
