New Hlds Exploit

Eternal_BlissEternal_Bliss Join Date: 2002-11-07 Member: 7633Members, NS1 Playtester, Contributor
edited July 2003 in General Server Discussion
<div class="IPBDescription">For win32 and Linux</div> <a href='http://www.securityfocus.com/archive/1/330880/2003-07-26/2003-08-01/0' target='_blank'>http://www.securityfocus.com/archive/1/330...26/2003-08-01/0</a>
I will quote some of the major points:
<!--QuoteBegin--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin-->Versions:    1.1.1.0 and previous versions (including all MODs
              based on the game, such as Counter-Strike and DoD)
              3.1.1.1c1 and 4.1.1.1a of the free dedicated server
Platforms:    Windows and Linux
Bugs:        Remote buffer overflow and Denial of Service
Risk          High
<!--QuoteEnd--></td></tr></table><span class='postcolor'><!--QuoteEEnd-->
<!--QuoteBegin--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin-->The only limitation in this buffer-overflow is that some bytes can not
be used in the shellcode because they are delimiters or otherwise
reserved for use by the Half-Life protocol. This puts some minor
constraints on the execution of the remote code, but is far from
limiting.

Further, there is a Denial of Service vulnerability that completely
freezes the server, entering it into an infinite loop.
<!--QuoteEnd--></td></tr></table><span class='postcolor'><!--QuoteEEnd-->
<!--QuoteBegin--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin-->The proof-of-concept exploit is very simple, and acts partly as a DoS
and a code execution exploit.

The return address is overwritten with the offset of a function in
SWDLL.DLL that displays a message in the console of the dedicated
server, after which it crashes.
This approach was chosen to demonstrate actual code execution without
endangering the administrator, enabling the admin to easily verify
whether the server is vulnerable.
The POC exploit can be used against both the dedicated and the game
servers, overwriting the stored address with 0x063c27f5.
<!--QuoteEnd--></td></tr></table><span class='postcolor'><!--QuoteEEnd-->
<!--QuoteBegin--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin-->Valve was notified of this vulnerability on April 14 2003, and replied
that they were working to patch these bugs.
<!--QuoteEnd--></td></tr></table><span class='postcolor'><!--QuoteEEnd-->


<b><!--QuoteBegin--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> </td></tr><tr><td id='QUOTE'><!--QuoteEBegin-->Half-Life 1.1.1.0 dedicated server (retail game):

<a href='http://www.pivx.com/luigi/patches/hlbof-server-1110-fix.zip' target='_blank'>http://www.pivx.com/luigi/patches/hlbof-se...er-1110-fix.zip</a>


Half-Life 4.1.1.1a dedicated server for Windows:

<a href='http://www.pivx.com/luigi/patches/hlbof-server-4111a-fix.zip' target='_blank'>http://www.pivx.com/luigi/patches/hlbof-se...r-4111a-fix.zip</a><!--QuoteEnd--></td></tr></table><span class='postcolor'><!--QuoteEEnd--></b>
<b>Note: The above fix is not an official fix!</b>

Protect your servers people.
Off Topic Disagree Agree Awesome

Comments

  • voogruvoogru Naturally Modified (ex. NS programmer) Join Date: 2002-10-31 Member: 1827Members, Retired Developer, NS1 Playtester, Contributor, Constellation
    I was unable to get the fix to work, It patches the file fine.


    BUT, it says "Your executable is out of date" when trying to auth with WON or whatever.


    <!--emo&:(--><img src='http://www.unknownworlds.com/forums/html/emoticons/sad.gif' border='0' style='vertical-align:middle' alt='sad.gif'><!--endemo-->
    Off Topic Disagree Agree Awesome
  • BonelessBoneless Join Date: 2002-09-03 Member: 1270Members
    stupid fix ins only meant for 4.1.1.1a so if u have your server upgraded to 4.1.1.1c1, it is vulnerable. No patch is provided for any Linux version.

    The workaround for the exploit is to set the server's password, but then no Free For All obviously... <!--emo&???--><img src='http://www.unknownworlds.com/forums/html/emoticons/confused.gif' border='0' style='vertical-align:middle' alt='confused.gif'><!--endemo-->
    Off Topic Disagree Agree Awesome
  • SiliconSilicon Join Date: 2003-02-18 Member: 13683Members
    edited July 2003
    <!--QuoteBegin--voogru+Jul 29 2003, 10:10 PM--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> (voogru @ Jul 29 2003, 10:10 PM)</td></tr><tr><td id='QUOTE'><!--QuoteEBegin--> I was unable to get the fix to work, It patches the file fine.


    BUT, it says "Your executable is out of date" when trying to auth with WON or whatever.


    <!--emo&:(--><img src='http://www.unknownworlds.com/forums/html/emoticons/sad.gif' border='0' style='vertical-align:middle' alt='sad.gif'><!--endemo--> <!--QuoteEnd--></td></tr></table><span class='postcolor'><!--QuoteEEnd-->
    says the same thing when I tried it out. but at least it protects your server from this particular exploit.
    Off Topic Disagree Agree Awesome
  • EvilGrinEvilGrin Join Date: 2002-11-04 Member: 6851Members
    Heres the 4111c version.

    <a href='http://www.pivx.com/luigi/patches/hlbof-server-4111c1-fix.zip' target='_blank'>http://www.pivx.com/luigi/patches/hlbof-se...-4111c1-fix.zip</a>
    Off Topic Disagree Agree Awesome
  • BonelessBoneless Join Date: 2002-09-03 Member: 1270Members
    Thanks,,, i'll give it a try <!--emo&:)--><img src='http://www.unknownworlds.com/forums/html/emoticons/smile.gif' border='0' style='vertical-align:middle' alt='smile.gif'><!--endemo-->
    Off Topic Disagree Agree Awesome
  • NaxoNaxo Join Date: 2003-04-10 Member: 15385Members, Constellation
    If you have the password, you can still use the exploit on the server. Means you have to change it all the time to avoid leaks etc...
    Off Topic Disagree Agree Awesome
  • FunkaFunka Join Date: 2002-11-03 Member: 5718Members
    any chance for a linux patch?

    for the first time since the first week of November, 2002, i have had to kill our NS server until an acceptable resolution can be found. (this is even more unfortunate as i was really looking forward to installing NS2.0 today... )

    thanks,
    -f!
    Off Topic Disagree Agree Awesome
  • SuperBOBSuperBOB Join Date: 2003-02-21 Member: 13795Members
    REALLY annoying me now, using IPTables + Pwd'ing games to minimize this.
    Come on valve..
    Off Topic Disagree Agree Awesome
  • wendigowendigo Join Date: 2002-11-13 Member: 8371Members
    My DOD server was attacked in this manner yesterday. If anyone wants the log and info of the person who did it please email me and I will send it.

    Wendigo
    Off Topic Disagree Agree Awesome
  • MasterShakeMasterShake Join Date: 2003-04-20 Member: 15699Members
    edited July 2003
    So why are we just finding out about this if Valve was notified in April?
    Off Topic Disagree Agree Awesome
  • devicenulldevicenull Join Date: 2003-04-30 Member: 15967Members, NS2 Playtester, Squad Five Blue
    To give them a chance to fix it I would think...
    I am gonna take a wild guess that now the number of attacks that are seen using this is gonna go up.
    Off Topic Disagree Agree Awesome
  • NiteowlNiteowl Join Date: 2002-09-04 Member: 1274Members, NS1 Playtester, Contributor
    where is the 'official' patch for 4.1.1.0 to 4.1.1.1a? i got a link to one.. but not sure how compromised it is.
    Off Topic Disagree Agree Awesome
  • voogruvoogru Naturally Modified (ex. NS programmer) Join Date: 2002-10-31 Member: 1827Members, Retired Developer, NS1 Playtester, Contributor, Constellation
    Well, The fix works but when you do it, you cant authenticate with won.

    Seeing from the mailing list, valve is working on releasing a patch today.
    Off Topic Disagree Agree Awesome
  • FlyFlownFlyFlown Join Date: 2003-04-26 Member: 15847Members, Constellation
    Found by gueri on the forum of United Admins.
    <a href='http://forums.unitedadmins.com/index.php?act=ST&f=55&t=29934' target='_blank'>http://forums.unitedadmins.com/index.php?a...ST&f=55&t=29934</a>
    Enjoy
    Off Topic Disagree Agree Awesome
Sign In or Register to comment.