its alredy fixed (dproto) 2012/8/7 Alfred Reynolds <[email protected]>
> I dug into a user report of this, they were running a plugin that lets > people from stolen versions of the game play on servers (dproto), that > software has (at least one) bug that means you can be attacked. So yeah, be > careful the 3rd party software you use on a server, and if its job is to > let people steal the game.... > > - Alfred > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Alfred Reynolds > Sent: Monday, August 06, 2012 9:41 AM > To: Half-Life dedicated Linux server mailing list > Subject: Re: [hlds_linux] New 1.6 Exploit very dangerous! > > Right, they both require a challenge. > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Saul Rennison > Sent: Saturday, August 04, 2012 11:03 AM > To: Half-Life dedicated Linux server mailing list > Subject: Re: [hlds_linux] New 1.6 Exploit very dangerous! > > Don't A2S_RULES and A2S_PLAYERS require a challenge? That completely breaks > spoofed IP attacks. > > > Kind regards, > *Saul Rennison* > > > On 4 August 2012 18:41, Oskar Levin <[email protected]> wrote: > > > I'm not sure this is fixed. It's still possible to get the convars of the > > server, right? Then it must still be possible to craft a UDP packet with > a > > spoofed sender and that way make the server send a reply to the spoofed > IP > > address? > > > > Best regards > > Oskar Levin > > [email protected] > > > > -----Ursprungligt meddelande----- > > Från: [email protected] > > [mailto:[email protected]] För John > > Skickat: den 4 augusti 2012 19:05 > > Till: [email protected] > > Ämne: Re: [hlds_linux] New 1.6 Exploit very dangerous! > > > > On 8/3/2012 7:50 PM, LocalStrike | Live your game! wrote: > > > i read this from a forum and at this time we have the same situation > > here! > > > please we need a fix asap! > > > > Valve fixed this attack in the most recent Goldsrc engine release (July > > 31): > > > > "... This update fixes a potential vulnerability in the > challenge/response > > protocol uses for out of band queries (in particular A2S_RULES and > > A2S_PLAYERS responses)... " > > > > Since it's not a required release, many server operators are not running > it > > yet. > > > > In terms of what you can do to block the reflected attack on your end > > without waiting for others to update, you could use string-based rules > that > > look for common cvars that will show in most output, or you could have a > > script that generates a list of IPs to block from tcpdump output and > pushes > > that list into an "ipset" set, to be blocked with a single iptables rule. > > > > -John > > > > _______________________________________________ > > To unsubscribe, edit your list preferences, or view the list archives, > > please visit: > > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > > > > > _______________________________________________ > > To unsubscribe, edit your list preferences, or view the list archives, > > please visit: > > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > > _______________________________________________ > To unsubscribe, edit your list preferences, or view the list archives, > please visit: > https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux > _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: https://list.valvesoftware.com/cgi-bin/mailman/listinfo/hlds_linux
