A hacked client has been developed that causes other people's bzflag clients to crash. One name the player went by was 'system god'. Although I think others were used.
I got a stack trace of the problem, and conjectured what the cause was.
I put in a fix, and the fix works.
It's possible that i found another problem, unrelated to system god, but if it is the same vulnerability, then the problem is solved.
So, if you build, pull down the latest, and use that.
If you are windows, you can get an installer at
http://www.chesco.com/~dbrosius/BZFlag/ ... zfinst.exe
If this still doesn't work, lemme know.
'system god' et. al. problems
-
MrApathyCream
- Dev Wizard
- Posts: 66
- Joined: Fri Dec 06, 2002 9:16 pm
- Location: Warwick, MD
- Contact:
Apathy,
Your response time is absolutely aweomse! :thumb:
Thank you so much for jumping right on top of this security hole. Wow, even those who work on top-secret encryption projects would be proud of your response time! hehehe
This happened to me, and I chalked it up to client crash. Then it happened twice right after restarting and entering the same server. I knew something wasn't right. So, I logged in once more, got in to turkey.moongroup, and after saying good bye, client crashed again! Now I knew someone was up to no good.
I will get the latest CVS from sourceforge and build. Thanks!
Your response time is absolutely aweomse! :thumb:
Thank you so much for jumping right on top of this security hole. Wow, even those who work on top-secret encryption projects would be proud of your response time! hehehe
This happened to me, and I chalked it up to client crash. Then it happened twice right after restarting and entering the same server. I knew something wasn't right. So, I logged in once more, got in to turkey.moongroup, and after saying good bye, client crashed again! Now I knew someone was up to no good.
I will get the latest CVS from sourceforge and build. Thanks!
protected object myTank(){
foreach(noob in this.game){return frag(noob);}}
foreach(noob in this.game){return frag(noob);}}
-
Fiberchunks
- Administrator
- Posts: 397
- Joined: Tue Dec 03, 2002 5:58 am
- Location: Groton, CT
hear hear..
Good deal -- grabbing the source right now.
Nice work MAC
Peace
Nice work MAC
Peace
-
Dutchrai
- Private First Class
- Posts: 394
- Joined: Sat Dec 07, 2002 3:12 am
- Location: Singapore
- Contact:
Haven't experienced it yet, but does anyone know if this affects *nix users too?
[img:82d1e9b9a0]http://shellshock.bzflag.bz/images/forum/bbbanner.png[/img:82d1e9b9a0]
[color=#405070:82d1e9b9a0]
Visit Shell Shock at [b:82d1e9b9a0]http://shellshock.bzflag.bz[/b:82d1e9b9a0] for news, maps, tactical guides, game servers and more
[/color:82d1e9b9a0]
[color=#405070:82d1e9b9a0]
Visit Shell Shock at [b:82d1e9b9a0]http://shellshock.bzflag.bz[/b:82d1e9b9a0] for news, maps, tactical guides, game servers and more
[/color:82d1e9b9a0]
-
MrApathyCream
- Dev Wizard
- Posts: 66
- Joined: Fri Dec 06, 2002 9:16 pm
- Location: Warwick, MD
- Contact:
Mea culpa
Erg, 
I did indeed fix the problem, but tested on a non-richochet server. The fix is not right for richochet servers. Chestal has since fixed the fix, and so if you pulled the cvs code (or downloaded the win installer) before 9:00PM EST, please get a new one.
BTW, as far as unix is concerned, I would expect that it should impact anyone, however BZFlag who i believe runs debian, didn't have the problem occur to him. So i'm not sure about that.
I did indeed fix the problem, but tested on a non-richochet server. The fix is not right for richochet servers. Chestal has since fixed the fix, and so if you pulled the cvs code (or downloaded the win installer) before 9:00PM EST, please get a new one.
BTW, as far as unix is concerned, I would expect that it should impact anyone, however BZFlag who i believe runs debian, didn't have the problem occur to him. So i'm not sure about that.
-
Fiberchunks
- Administrator
- Posts: 397
- Joined: Tue Dec 03, 2002 5:58 am
- Location: Groton, CT
lol..
That's funny that you mention ricochet, as I was playing on turkey last night, and was wondering: "when did kp make this a non-richochet server?" 
I'll get the new client tonite...it was pretty neat though - no shots passed through teleporters!
Peace
I'll get the new client tonite...it was pretty neat though - no shots passed through teleporters!
Peace
-
michaelh20
- Private First Class
- Posts: 57
- Joined: Thu Dec 12, 2002 2:28 am
- Location: MN USA
Were the changes significant enough that you couldn't just post some details on what you changed for the client? (i.e. don't bother if it's pages of changes) I've got my own code changed a bit and I hate to have to keep re-changing new code to what I like...
Did you have to change both client and server?
Did you have to change both client and server?
Use the CVS browsing feature on sourceforge. This lets you see differences between 2 versions for each file. If you like to run your own client with modifications (which ones btw., maybe they're of interest for everyone?) I'd recommend to use CVS to keep your local copy up to date anyway. It should usually merge CVS chanegs with your changes without a problem.michaelh20 wrote:Were the changes significant enough that you couldn't just post some details on what you changed for the client?
-
swine
- Private First Class
- Posts: 24
- Joined: Fri Dec 06, 2002 11:13 pm
- Location: Nanaimo, B.C. Canada
- Contact:
god problems
FYI guys
It does crash the *nix clients. I'm running mandrake 9 and I kept getting crashed on my own server. To say I was annoyed would be an understatement along the lines of saying King Kong was just a cheeky chimp.
And the response time to this threat was amazing! There ARE bzgods andI find that they are good!
and the people rejoiced, blowing each other up with glee, and they fed upon the land, and breakfast cereal, and oakchairs and goats (but the swine they set free of course)...
It does crash the *nix clients. I'm running mandrake 9 and I kept getting crashed on my own server. To say I was annoyed would be an understatement along the lines of saying King Kong was just a cheeky chimp.
And the response time to this threat was amazing! There ARE bzgods andI find that they are good!
and the people rejoiced, blowing each other up with glee, and they fed upon the land, and breakfast cereal, and oakchairs and goats (but the swine they set free of course)...