HLDS Exploit

[Frito Bandito]

Simplex wrote..

Thanks joe for letting me know it was on BUGTRAQ. I found it. Maybe that wasn't the best idea. Maybe my post is going to get deleted as well...



Practically, what this means is that any joe (not that joe) who rents a server from a server farm (who is then given rcon access) can take control of the server computer where there are probably a few more servers running and have his filthy way with them (like a french whore*). Or he can just screw stuff up enough so the server computer would need to be reformatted.



-OR-



The little guy like me hosts a server on my personal computer and lets a little guy I kinda know (plays CS real well) have admin privileges on my server when I'm out gets his computer trashed because this guy I thought I knew wanted to be an ass.**



* My apologies to all the stupid communist bastards*** I offended.

** Story completely fictional.

*** My apologies to all the communist bastards**** I've offended.

**** My apologies to all the fatherless people out there.

Yes, it is very easy to find the source when someone tells you where to look. You might as well have posted the link joe. A simple search turned it up as the first result. In fact, I'm looking at the source right now. Apperantly this was done in Brazil, or maybe BUGTRAQ is a Brazillian website and added their own comments?



Either way, you said too much joe. As simplex said, now anyone who decides he wants to screw with a server knows where to look. Good thing I'm not running my server for awhile. Maybe at the next LAN i go to....

[MikeJ]

this exploit only effects people running metamod right?

[Serious Sam]

So exactly is the correct thing to do?



O_p

[rizzuh]

Like the news post says, disable rcon access and run your server via adminmod.

mouth wrote..

This news item was worth it just to see those 2 jackasses patting themselves on the back for managing to get a single relevant newpost up.

Hahahaha!!!!

[MikeJ]

as far as i can tellt his exploit only effects meta mod servers correct?

[DrMagus]

Edited by [user="16289"] @ [time="1042318568"]

mouth wrote..

This news item was worth it just to see those 2 jackasses patting themselves on the back for managing to get a single relevant newpost up.

My, we have a lot of hate here. Define relevant and maybe you'll make sense. In the mean time shut your pie hole until you can:

a) define what you mean

or b) show how you could do a much better job

I don't care if you don't like what's posted, but until you can show definitions, relevance or how you could do it better to your nonsensical statements, you look like more and more a fool.



Journalistic common also dictates that since this site gets so many hits you don't post anything that could make you liable. I'm not gonna take any rap for some 12 year old that decides to take down ANY server. If Bugtraq wants to post it, it's their right and OBLIGATION to post it to let people know. We just have to let you know that it's out there.

[Ritchey007]

MikeJ wrote..

as far as i can tellt his exploit only effects meta mod servers correct?

HLDS and HLTV are affected also... so you aren't completely safe.

[ProdigyPuNk]

A new advisory was just released, Statsme is now vulnerable too..

[Simplex]

DrMagus wrote..

My, we have a lot of hate here. Define relevant and maybe you'll make sense. In the mean time shut your pie hole until you can:

a) define what you mean

or b) show how you could do a much better job

I don't care if you don't like what's posted, but until you can show definitions, relevance or how you could do it better to your nonsensical statements, you look like more and more a fool.

Calm down buddy. I thought it was funny. You wrote "/me high fives Ritchey007". I laff at you too. :P Even your "boss" thought it was funny.



Even though you look like a fool (flashing red lights... this is now a flame!) and not him, I do like your use of the word nonsensical. It's gonna be my word of the day!

[DrMagus]

Lol.

[Serious Sam]

You know if you don't like this type of news, or would like to see less...



THERE ARE CONTENT FILTERS!



Yeesh. Would save csn uneccssary bandwith usage. =|

[ProdigyPuNk]

Hm... So far there are 2 admin mod hacks, 1 Clanmod hack, 1StatsMe hack, and 1 HL-TV hack (DoS).



Edit: The news article doesn't mention the HLTV DoS, the other adminmod hack, the clanmod hack, or the StatsMe hack.

[DrMagus]

ProdigyPuNk wrote..

Hm... So far there are 2 admin mod hacks, 1 Clanmod hack, 1StatsMe hack, and 1 HL-TV hack (DoS).



Edit: The news article doesn't mention the HLTV DoS, the other adminmod hack, the clanmod hack, or the StatsMe hack.

At the time we didn't know about them.

[ProdigyPuNk]

DrMagus wrote..

At the time we didn't know about them.

You could post an update...

[DrMagus]

ProdigyPuNk wrote..

You could post an update...

alrighty then.