Author Topic: CRITICAL BUG FOUND, PLEASE UPGRADE YOUR SERVERS (Read 26279 times)

Amanieu · « **on:** June 07, 2008, 03:28:50 pm »

A very serious bug has been found, which affects every single Tremulous server. I will not disclose any information about how to reproduce it. If you do know, please do not tell people about it, it will only make this situation worse.

For server owners:
Check to see if a newer version of the qvm you are using is available. Notify the authors if that has not been done yet.

For qvm makers:
Apply the following patch to your code and release a new version of your qvm immediately.
http://code.google.com/p/p-g-qvm/issues/detail?id=111
Thanks to Rezyn for the patch!

David · « **Reply #1 on:** June 07, 2008, 04:25:11 pm »

If your QVM doesn't have an update, use laks, its fixed and released.

/dev/humancontroller · « **Reply #2 on:** June 07, 2008, 04:28:48 pm »

Now let's go crash some servers! xD

Divmax · « **Reply #3 on:** June 07, 2008, 04:33:07 pm »

1.1.0 vanilla servers are safe, although they already have a lot of bugs.

QVM Status:
PGQVM - Updated and has released an official version.
Amanieu's QVM - Updated and has released an official version.
Lakitu7's QVM - Updated and has released an official version.
TremWars QVM - Updated in the SVN and on the server.
Equilibrium QVM - Updated and has released an official version.
Tremulous SVN - Updated and fixed from r1090 onwards.

Red denotes that it isn't fixed.
Green denotes it is fixed.

Links to fixed QVMs(You might be required to compile)
Just Download :
Lakitu7's Latest QVM
PGQVM
Required to compile:
Amanieu's QVM(Fixed in SVN)
TremWars QVM(Fixed in SVN)

Quote from: /dev/humancontroller on June 07, 2008, 04:28:48 pm

Now let's go crash some servers! xD

Seriously, don't.

Amanieu · « **Reply #4 on:** June 07, 2008, 04:49:09 pm »

Tremulous svn is also affected btw. I already submitted a bug report.

Paradox · « **Reply #5 on:** June 07, 2008, 06:02:31 pm »

PGQVM updated. Download now featured

Divmax · « **Reply #6 on:** June 07, 2008, 06:33:25 pm »

People using Lakitu's QVM and TremWars QVM, please update because a new exploit is found.

Amanieu · « **Reply #7 on:** June 07, 2008, 06:33:57 pm »

Lakitu7's qvm 5.21 still has the bug in another form. Must upgrade to 5.22.

Lakitu7 · « **Reply #8 on:** June 07, 2008, 07:11:06 pm »

5.22 posted. Everyone did rather jump the gun in assuming that the 5.21 I released last night was this bug rather than the bug it actually was. Oh well.

Amanieu needs to not release bugs so publically next time so things are not so frantic. The actual exploit was on public irc before anyone had fixes. That's no good.

Also Trem SVN needs someone to commit this.

Rocinante · « **Reply #9 on:** June 07, 2008, 07:19:10 pm »

And someone was running around to other servers crashing them intentionally...

blood2.0 · « **Reply #10 on:** June 07, 2008, 07:44:52 pm »

i am confused what is the bug?!

Rocinante · « **Reply #11 on:** June 07, 2008, 08:17:59 pm »

It causes servers to crash. That's already more than should be "in the wild" about this, but since the cat was already let out of the bag that's as much as will be discussed in public :>

ziplocpeople · « **Reply #12 on:** June 07, 2008, 08:36:14 pm »

This bug seems to be a very big pain. I can only hope that all the trem servers will update IMMEDIATELY. This bug has allready caused enough trouble, and I don't want to see any more crashes because of it.

+ OPTIMUS + · « **Reply #13 on:** June 07, 2008, 09:15:26 pm »

!!!GRIN!!!

what was this? :-) attack of the killer bees? sounded like if a bug would've set a granger free from the game :-D

zaborack · « **Reply #14 on:** June 07, 2008, 11:13:06 pm »

The 'Unlimited BP' server will hopefully be up and running again soon, with a new QVM.
Thank you for your help.

AirJordan · « **Reply #15 on:** June 08, 2008, 12:52:54 am »

doesnt work for me.....not for Mac OSX

Lakitu7 · « **Reply #16 on:** June 08, 2008, 01:08:03 am »

Quote from: AirJordan on June 08, 2008, 12:52:54 am

doesnt work for me.....not for Mac OSX

This has absolutely nothing to do with what version of anything you are running. It affects QVM files, which are platform independent. If you are not running a public Tremulous server which runs a game.qvm other than the one that comes with it, this does not affect you. If you are only a player with a client, this does not affect you.

If you do run a server and are trying to apply this patch to qvm files that you compile yourself, this patch will not change whether or not it compiles. If you already have a working build environment, it will work. If not, it will not.

Le Compilateur · « **Reply #17 on:** June 08, 2008, 04:44:20 am »

Equilibrium QVM 2.5 released. Contains bugfix patch. Note: previous versions do not contain the patch and as such are still susceptible to this bug.

wireddd · « **Reply #18 on:** June 08, 2008, 10:10:04 pm »

All of the Knights of Reason servers are patched, including the tremx server. If you are running a custom qvm I made and need help, or a new one, let me know via a pm here or on my forums, and I will help you out.

Paradox · « **Reply #19 on:** June 09, 2008, 06:20:03 pm »

I saw a person attempting to crash servers yesterday.
One of my admins wrote down his IP.

If you want it, ill pm you

Le Compilateur · « **Reply #20 on:** June 09, 2008, 08:23:16 pm »

I'd like it please. I don't want this jerk coming on my server(s).

Vociferous · « **Reply #21 on:** June 10, 2008, 01:52:28 pm »

Takhis.net was updated a few days ago, was the first thing i did when i heard of a exploit in the wild.

slux_ITA · « **Reply #22 on:** June 12, 2008, 01:19:11 pm »

MxB private server fixed with the last paradox QVM.
Prolinux server will be fixed soon!

Thanks to all!

tuple · « **Reply #23 on:** June 12, 2008, 04:21:52 pm »

FWIW, I wouldn't announce servers that haven't been or will be patched. You'll just atract the party crashers.

Le Compilateur · « **Reply #24 on:** June 12, 2008, 08:32:22 pm »

You mean the server crashers...

blood2.0 · « **Reply #25 on:** June 12, 2008, 08:37:29 pm »

ok at least what is the error message and how do i pach

TinMan · « **Reply #26 on:** June 12, 2008, 08:59:34 pm »

Quote from: Amanieu on June 07, 2008, 03:28:50 pm

I will not disclose any information about how to reproduce it. If you do know, please do not tell people about it, it will only make this situation worse.

LOL SECURITY THROUGH OBSCURITY! Too bad this game is OpenSource. When you find a bug you tell everybody, then it gets fixed.
This was useful for buffer overflows mid-scrim

David · « **Reply #27 on:** June 13, 2008, 12:56:43 pm »

Quote from: TinMan on June 12, 2008, 08:59:34 pm

LOL SECURITY THROUGH OBSCURITY!

LOL CAN'T READ!
Please learn about the concept of "Security by Obscurity" so you can understand what it is your talking about.

TinMan · « **Reply #28 on:** June 13, 2008, 08:54:58 pm »

Um, David, re-read that, let it sink in, and then you'll understand. The first post in this thread is about not telling others about the problem but just having QVM developers apply the path to their new releases. That would fall under a method of "security through obscurity" if he doesn't want others looking into the issue or knowing about it.

What should happen is "Hey guys, there's a buffer overflow problem that some kiddies have been exploiting, don't be ignorant of it, go to this bug page, read into how it happens and make sure you get a new QVM with it patched, inform your server's admins about it, and spread the word to other server admins, especially the new ones."

(Mr. Comma is my biah)

David · « **Reply #29 on:** June 13, 2008, 11:36:48 pm »

Nobody is trying to 'hide' anything.
Not screaming it from the roof tops != security through obscurity.
Its just good common sense.
Security through obscurity would be not telling anyone how the pure check works, or not giving out the source code.
What's happening here is called full disclosure, and if in keeping with the de facto standard way would be a lot lighter on detail.

News:

Author Topic: CRITICAL BUG FOUND, PLEASE UPGRADE YOUR SERVERS (Read 26279 times)

blood2.0

blood2.0