BID:8300

Valve Software Half-Life Server Multiplayer Request Buffer Overflow Vulnerability

Info

Valve Software Half-Life Server Multiplayer Request Buffer Overflow Vulnerability

Bugtraq ID:	8300
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 29 2003 12:00AM
Updated:	Oct 17 2007 01:27AM
Credit:	Discovery is credited to Auriemma Luigi <[email protected]>.
Vulnerable:	Valvesoftware Half-Life Dedicated Server 4.1.1 .1c1 Win32 Valvesoftware Half-Life Dedicated Server 4.1.1 .0 Win32 + Valvesoftware Half-Life 1.1.1 .0 + Valvesoftware Half-Life 1.1 .0.9 + Valvesoftware Half-Life 1.1 .0.8 + Valvesoftware Half-Life 1.1 .0.4 Windows Valvesoftware Half-Life Dedicated Server 4.1 .0.9 Win32 + Valvesoftware Half-Life 1.1.1 .0 + Valvesoftware Half-Life 1.1 .0.9 + Valvesoftware Half-Life 1.1 .0.8 + Valvesoftware Half-Life 1.1 .0.4 Windows Valvesoftware Half-Life Dedicated Server 4.1 .0.8 Win32 + Valvesoftware Half-Life 1.1.1 .0 + Valvesoftware Half-Life 1.1 .0.9 + Valvesoftware Half-Life 1.1 .0.8 + Valvesoftware Half-Life 1.1 .0.4 Windows Valvesoftware Half-Life Dedicated Server 4.1 .0.7 Win32 + Valvesoftware Half-Life 1.1.1 .0 + Valvesoftware Half-Life 1.1 .0.9 + Valvesoftware Half-Life 1.1 .0.8 + Valvesoftware Half-Life 1.1 .0.4 Windows Valvesoftware Half-Life Dedicated Server 4.1 .0.6 Win32 + Valvesoftware Half-Life 1.1.1 .0 + Valvesoftware Half-Life 1.1 .0.9 + Valvesoftware Half-Life 1.1 .0.8 + Valvesoftware Half-Life 1.1 .0.4 Windows Valvesoftware Half-Life Dedicated Server 4.1 .0.4 Win32 + Valvesoftware Half-Life 1.1.1 .0 + Valvesoftware Half-Life 1.1 .0.9 + Valvesoftware Half-Life 1.1 .0.8 + Valvesoftware Half-Life 1.1 .0.4 Windows Valvesoftware Half-Life Dedicated Server 3.1.1 .1c1 Linux Valvesoftware Half-Life Dedicated Server 3.1.1 .0 Linux + Valvesoftware Half-Life 1.1 .0.4 Linux Valvesoftware Half-Life Dedicated Server 3.1 .0.9 Linux + Valvesoftware Half-Life 1.1 .0.4 Linux Valvesoftware Half-Life Dedicated Server 3.1 .0.8 Linux + Valvesoftware Half-Life 1.1 .0.4 Linux Valvesoftware Half-Life Dedicated Server 3.1 .0.7 Linux + Valvesoftware Half-Life 1.1 .0.4 Linux Valvesoftware Half-Life Dedicated Server 3.1 .0.6 Linux + Valvesoftware Half-Life 1.1 .0.4 Linux Valvesoftware Half-Life Dedicated Server 3.1 .0.5 Linux + Valvesoftware Half-Life 1.1 .0.4 Linux Valvesoftware Half-Life Dedicated Server 3.1 .0.4 Linux + Valvesoftware Half-Life 1.1 .0.4 Linux Valvesoftware Half-Life 1.1.1 .0 Valvesoftware Half-Life 1.1 .0.9 Valvesoftware Half-Life 1.1 .0.8 - Microsoft Windows 98 SP1 - Microsoft Windows 98 b - Microsoft Windows 98 a - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Valvesoftware Half-Life 1.1 .0.4 Windows - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 Valvesoftware Half-Life 1.1 .0.4 Linux - Caldera OpenLinux 2.4 - Debian Linux 2.2 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Mandriva Linux Mandrake 7.0 - Redhat Linux 7.0 i386 - Redhat Linux 6.2 i386 - SCO eDesktop 2.4 - SCO eServer 2.3.1 - SuSE Linux 7.0 - SuSE Linux 6.4

Not Vulnerable:	Valvesoftware Half-Life Dedicated Server 4.1.1 .1d Beta Win32 Valvesoftware Half-Life Dedicated Server 4.1.1 .1c1 Win32

Discussion

Valve Software Half-Life Server Multiplayer Request Buffer Overflow Vulnerability

Half-Life servers are prone to a buffer overflow that may be exploited by a malicious remote client. The vulnerability occurs because the software fails to sufficiently bounds-check client-supplied data during requests to join multiplayer games. This could allow attackers to execute code in the context of the vulnerable server.

This vulnerability affects the server bundled with Half-Life and the free Dedicated Server for both Windows and Linux operating systems.

Exploit / POC

Valve Software Half-Life Server Multiplayer Request Buffer Overflow Vulnerability

A proof of concept is available at the following location:

http://www.pivx.com/luigi/poc/hlbof-server.zip

The following exploits have also been provided:

/data/vulnerabilities/exploits/pu-hl.c
/data/vulnerabilities/exploits/8300.c

Solution / Fix

Valve Software Half-Life Server Multiplayer Request Buffer Overflow Vulnerability

Solution:
The vendor has released an upgrade to address this issue. Users are advised to install the upgrade as soon as possible.

Valvesoftware Half-Life Dedicated Server 3.1 .0.9 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 3.1 .0.7 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 3.1 .0.5 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 3.1 .0.4 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 3.1 .0.6 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 3.1 .0.8 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 3.1.1 .0 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 3.1.1 .1c1 Linux

Valve Software hlds_l_3111d_update.tar.gz
ftp://ftp.valvesoftware.com/Linux/hlds_l_3111d_update.tar.gz

Valvesoftware Half-Life Dedicated Server 4.1 .0.6 Win32

Valve Software hlds4111d_beta.exe
ftp://ftp.valvesoftware.com/Win32/hlds4111d_beta.exe

Valvesoftware Half-Life Dedicated Server 4.1 .0.9 Win32

Valve Software hlds4111d_beta.exe
ftp://ftp.valvesoftware.com/Win32/hlds4111d_beta.exe

Valvesoftware Half-Life Dedicated Server 4.1 .0.4 Win32

Valve Software hlds4111d_beta.exe
ftp://ftp.valvesoftware.com/Win32/hlds4111d_beta.exe

Valvesoftware Half-Life Dedicated Server 4.1 .0.7 Win32

Valve Software hlds4111d_beta.exe
ftp://ftp.valvesoftware.com/Win32/hlds4111d_beta.exe

Valvesoftware Half-Life Dedicated Server 4.1 .0.8 Win32

Valve Software hlds4111d_beta.exe
ftp://ftp.valvesoftware.com/Win32/hlds4111d_beta.exe

Valvesoftware Half-Life Dedicated Server 4.1.1 .1c1 Win32

Valve Software hlds4111d_beta.exe
ftp://ftp.valvesoftware.com/Win32/hlds4111d_beta.exe

Valvesoftware Half-Life Dedicated Server 4.1.1 .0 Win32

Valve Software hlds4111d_beta.exe
ftp://ftp.valvesoftware.com/Win32/hlds4111d_beta.exe

References

Valve Software Half-Life Server Multiplayer Request Buffer Overflow Vulnerability

References:

Half-Life servers: buffer-overflow and freeze (Auriemma Luigi )