HLDS Exploit Fix

[CSN NewsBot]

Following on the heels of the HLDS exploit discovered earlier this week VALVe software has released an update to fix the security vulnerabilities. Currently there are no mirrors other than the VALVe official FTP server but for now you can find the update here, and below you can find the change log and the e-mail that Eric Smith sent about the update.[break="Eric Smith's email"]

We've put the x.1.1.1d beta release on our FTP site. Server admin should update their servers to x.1.1.1d to protect against security exploits.



You can grab the "d" beta release here:



ftp.valvesoftware.com

login: hlserver

pass: hlserver



Win32

file: hlds4111d_beta.exe

md5: f523557dac8dcfc1ccde6c8958bc9b52



Linux

file: hlds_l_3111d_update.tar.gz

md5: fb45a812d4940b1603d894a25b961ec8



Here's the change list for the "d" release:

changes/additions


• added bot count to "details" server query reply.
  
  
• flipped anti-dos logic to check per user and then global rate limits. changed it so users exceeding personal rates don't add into the global rate calculations.
  
  
• performed optimizations on engine to improve performance.
  
  
• linux: added "-pidfile " argument to hlds to get it to write the pid of the dedicated server process to the file specified.
  
  
• linux: improved "-debug" command to look for core. files.
  
  
• linux: hlds echoes to the controlling tty rather than stdout (solves redirecting output no longer showing key presses).
  
  
• hltv: changed "status" output, more info displayed.
  
  
• hltv: added cvar "maxloss", default 0.05, if packet loss exceeds this threshold, new spectators are rejected.
  
  
• hltv: zero delay possible for direct broadcasts without game buffering ("delay 0").
  
  
  
  bug fixes
  
  
• fixed format string crash bug in logging.
  
  
• fixed infinite loop due to malformed infostring.
  
  
• hltv: fixed system timer problem.
  
  
• hltv: fixed missing end in hltv demos.
  
  
• hltv: fixed missing director commands with "playdemo" in hltv console.
  
  
• hltv: fixed max_ospath.

Let us know if you have any problems with this release and we'll look into them right away.



Thanks.



Eric Smith

VALVe

[MikeJ]

I tried to crash my own server but it said "this server appears invulnerable" or something of the sort.



Glad to hear there is an official update though.

[Maj.Death]

mike j you crazy dancing monkey!



</3 exploits



<3 for fixing

[DrMagus]

Changed from patch to update because I'm not really sure what the hell to call it o_O

[naem]

MikeJ wrote..

I tried to crash my own server but it said "this server appears invulnerable" or something of the sort.

It was probably passworded or you didn't try both types of crashing

Now hurry up and fix your servers admins :)

[MikeJ]

yea it was passworded i guess that's it.

[BeaMeR]

how do you crash it?

[Dirk]

Very carefully.



-dp-

[Buddah]

I put my server on the front end of my car and rammed it into a wall to crash it. :P

[kerosine99]

Buddah wrote..

I put my server on the front end of my car and rammed it into a wall to crash it. :P

HAHAHAHAHHAHAHAHHAHAHAHAH



......



HAHHAHAHAHAHHAHAH. HAhAH. HAH.... ahhh.

[BoNeLeSS]

omg die D:



Updated my servers... Lets see how much perfomance has been improved btw..

[DeAceShooter]

kerosine99 wrote..

HAHAHAHAHHAHAHAHHAHAHAHAH



......



HAHHAHAHAHAHHAHAH. HAhAH. HAH.... ahhh.

You've got a weird sense of humour. Go smell the keyboard.

[Steakeater]

Releasing the exploit in detail forced Valve to produce a fix - they did it in only 4 days. Thanks Valve!

[[PKM]GenocideS1]

Hl-Guard 1.50 Sucks Im anti-cheat but jeez... Valve isnt blocking models so why should Hl-Guard be. Please post no news about it. Modeling is hard work. How ANYONE could see using Insomniax swatpack or high quality weapons models as cheating is beyond me.

[hitnrun]

Well, my realbot (linux) core dumps on this ver.