Risks
Vulnerabilities
Browse by
Half-Life dedicated server vulnerability
17 October 2000
Bookmark and Share
Vulnerability Report by Mark Cooper

Date Published: 16th October 2000

Advisory ID: N/A

Bugtraq ID: 1799

http://www.securityfocus.com/bid/1799

CVE CAN: N/A

Title: Half-Life Dedicated Server Vulnerability

Class: Buffer Overflow

Remotely Exploitable: Yes

Locally Exploitable: Yes

Release Mode: FORCED RELEASE

This vulnerability is actively being exploited in the wild.

Vulnerable Packages/Systems:

Half-Life Dedicated Server for Linux 3.1.0.3 & Previous

Vulnerability Description:

A buffer overflow vulnerability was discovered in a Half-Life dedicated server during a routine security audit. A user shell was found running on the ingreslock port of the server which lead to an investigation into how this had been achieved. - From the logs left on the server, it was ascertained that a predefined exploit script was used and that the perpetrator failed to further compromise the server due to the Half-Life software running as a non-priveledged user.

The vulnerability appears to exist in the changelevel rcon command and does not require a valid rcon password. The overflow appears to exist after the logging function as the following was found in the last entries of the daemon's logs:-

# tail server.log.crash | strings
L 08/23/2000 - 23:28:59: "[CiC]Foxdie<266>" say "how so?"
Bad Rcon from x.x.x.x:4818:
rcon werd changelevel
bin@
sh!@
Privet ADMcrew\
rcon werd changelevel

The actual raw exploit code is logged, along with what appears to be the script authors, ADM ( http://adm.freelsd.net/ADM/ ). If they could shed some light on this?

Solution/Vendor Information/Workaround:

Valve Software promised a patch which has yet to appear. Interim measures would include:-

A) Consider not running the HalfLife software at all!
B) Remove the world execute bit from inetd to 'break' the exploit code - this would only stop the script kiddies
C) Ensure sane ipfwadm/ipchains filters are inplace

Vendor notified on: 14th September 2000

Credits:

Credit for the vulnerability discovery presumably lies with ADM. :) The forensic work which discovered this problem was performed by Mark Cooper.

This advisory was drafted with the help of the SecurityFocus.com Vulnerability Help Team. For more information or assistance drafting advisories please mail vulnhelp@securityfocus.com.

Exploit/Concept Code:

Try http://adm.freelsd.net/ADM/ ?

Referance: http://www.valvesoftware.com

DISCLAIMER:
No responsibility whatsoever is taken for any correct/incorrect use of this information. This is for informational purposes only.




Spotlight

Internet Explorer vulnerabilities increase 100%

Posted on 23 July 2014.  |  Bromium Labs research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Wed, Jul 23rd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //