Server cfgs can be renamed randomly so they are easy to protect assuming that you can't get file list. System files are whole different thing. Chrooting works but it ain't acceptable to have a bug like this coz it's kinda likely that if someone uses this hole it won't take long to figure out some weak points just by guessing.<br>
<br><div class="gmail_quote">2010/1/20 B.M. Schiltmans <span dir="ltr"><<a href="mailto:b.m.schiltmans@planet.nl">b.m.schiltmans@planet.nl</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hmm, perhaps I should read first, and comment later. Sorry about that.<br>
So the problem is not http-redirect but the direct download.<br>
Am I correct in assuming that a modified client is needed for this 'hack'? In that case, it should be easy to fake a failed http-redirect and force a fallback to direct-download. Reading through it, it seems that the server.cfg is not the only worry, if every file on your server can be read.<br>
I see no workaround here, except maybe chroot. And even then your .cfg's are at risk.<br>
Only real solution would be a patch it seems.<br>
Anyone got any info on which games are/are not vulnerable (not counting the dinosaurs on securityfocus ;-) )?<br>
<br>
<br>
<br>
Geoff Goas wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
i know the difference here. the console log lines clearly stated (paraphrased) 'clientDownload <clientnum> : beginning "fs_game/server.cfg"'.<br>
<br>
only IWD's are contained in my HTTP redirect path.<br>
<br></div><div><div class="h5">
On Wed, Jan 20, 2010 at 3:32 AM, B.M. Schiltmans <<a href="mailto:b.m.schiltmans@planet.nl" target="_blank">b.m.schiltmans@planet.nl</a> <mailto:<a href="mailto:b.m.schiltmans@planet.nl" target="_blank">b.m.schiltmans@planet.nl</a>>> wrote:<br>
<br>
I highly doubt that this is exploited trough the game. The way I<br>
see it:<br>
- You connect to some server with http-redirect enabled, and note<br>
or memorize the http location that the downloads come from.<br>
- Start a browser, and go to the http-redirect-site<br>
- If you're 'lucky', you can see the cfg-files, either by browsing<br>
the directories, or by guessing the .cfg name(s)<br>
<br>
As an admin this can easily be prevented by any of the following:<br>
- Don't store config-files on the http-redirect, in fact, just<br>
store files there that actually need to be downloaded. Of course<br>
this only works if you have an separate redirect-space.<br>
- Instruct your webserver to not allow acces to thing like .cfg,<br>
.txt, etc etc<br>
- As an extra security/obscurity, just disable directory-browsing.<br>
Let's not make anyone any smarter than they need to be ;-)<br>
<br>
That should do the trick. Oh and one more thing (I learned the<br>
hard way), NEVER EVER use the rcon password for something like an<br>
os-user. IF someone finds out the password,.....<br>
<br>
As a sidenote for clan-based servers. Clans often want to update<br>
their usermaps all at once instead of on every map change. In this<br>
case the http-redirect is not ideal, so we use rsync to do that.<br>
When the server has updated maps, I send an email, and all they<br>
have to do is click some desktop-icon to update their own set. We<br>
implemented is because cod5 crashes a lot when it has to get an<br>
updated version of some map.<br>
<br>
Grtz<br>
Bram<br>
<br>
<br>
Tomé Duarte wrote:<br>
<br>
I believe when you're using HTTP redirect the gameserver<br>
automatically redirects all downloads to the configured URL.<br>
However, a custom application to exploit this misconfiguration<br>
may somehow be able to download the server.cfg; this depends<br>
on the server code but it's highly probable that it redirects<br>
the request to the webserver.<br>
<br>
Does anyone have any more info on this vuln? Is it just the<br>
sv_allowdownload cvar or are there any other "requirements"?<br>
Is there a published vuln report or exploit?<br>
<br>
Cheers,<br>
Tomé Duarte<br>
<br>
Connect with me via:<br>
Twitter: <a href="http://twitter.com/tomeduarte" target="_blank">http://twitter.com/tomeduarte</a><br>
LinkedIn: <a href="http://www.linkedin.com/in/tduarte" target="_blank">http://www.linkedin.com/in/tduarte</a><br>
<br>
<br>
On Wed, Jan 20, 2010 at 1:04 AM, Geoff Goas <<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a><br></div></div>
<mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a>> <mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a><div class="im"><br>
<mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a>>>> wrote:<br>
<br>
I do... I was under the impression that sv_allowdownload<br>
had to be<br>
enabled in order for HTTP redirect to work. Is that not the<br>
case?<br>
<br>
<br>
On Mon, Jan 18, 2010 at 7:36 PM, Mavrick Master<br>
<<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a> <mailto:<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a>><br>
<mailto:<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a><br>
<mailto:<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a>>>> wrote:<br>
<br>
Do you have the http redirect setup?<br>
<br>
If not, may I suggest you set this up and in the off-server<br>
http location only store the mod and not your config files.<br>
This should solve your problem.<br>
<br>
<br>
Daniel 'mavrick' Lang<br>
<a href="http://www.mavrick.id.au" target="_blank">www.mavrick.id.au</a> <<a href="http://www.mavrick.id.au" target="_blank">http://www.mavrick.id.au</a>><br>
<<a href="http://www.mavrick.id.au" target="_blank">http://www.mavrick.id.au</a>><br>
<br>
<br>
<br>
On Sun, Jan 17, 2010 at 2:45 PM, Geoff Goas<br>
<<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a> <mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a>><br></div><div class="im">
<mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a> <mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a>>>> wrote:<br>
<br>
That's correct.<br>
<br>
<br>
On Mon, Jan 11, 2010 at 7:25 PM, Mavrick Master<br>
<<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a><br>
<mailto:<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a>><br></div><div class="im">
<mailto:<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a><br></div><div class="im">
<mailto:<a href="mailto:mavrick.master@gmail.com" target="_blank">mavrick.master@gmail.com</a>>>> wrote:<br>
<br>
The client auto-download was used because I presume<br>
you are running a mod?<br>
<br>
Daniel 'mavrick' Lang<br>
<a href="http://www.mavrick.id.au" target="_blank">www.mavrick.id.au</a> <<a href="http://www.mavrick.id.au" target="_blank">http://www.mavrick.id.au</a>><br>
<<a href="http://www.mavrick.id.au" target="_blank">http://www.mavrick.id.au</a>><br>
<br>
<br>
<br>
<br>
On Thu, Dec 31, 2009 at 11:15 PM, Hannu Kumpeli<br>
<<a href="mailto:hannu@shadowstyle.nl" target="_blank">hannu@shadowstyle.nl</a><br></div>
<mailto:<a href="mailto:hannu@shadowstyle.nl" target="_blank">hannu@shadowstyle.nl</a>> <mailto:<a href="mailto:hannu@shadowstyle.nl" target="_blank">hannu@shadowstyle.nl</a><div><div class="h5"><br>
<mailto:<a href="mailto:hannu@shadowstyle.nl" target="_blank">hannu@shadowstyle.nl</a>>>><br>
<br>
wrote:<br>
<br>
well after they got the rcon pass they could<br>
change all non write protected<br>
<br>
> But they could only download and view, not<br>
edit.correct?<br>
><br>
><br>
><br>
> From: Geoff Goas [mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a><br>
<mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a>><br>
<mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a><br>
<mailto:<a href="mailto:gitman@gmail.com" target="_blank">gitman@gmail.com</a>>>]<br>
> Sent: Thursday, December 31, 2009 1:03 AM<br>
> To: Call of Duty server admin list.<br>
> Subject: [cod] A word of advice<br>
><br>
><br>
><br>
> This may not be news to some, but I just<br>
first<br>
hand experience with it, so I<br>
> think I should share....<br>
><br>
> Someone just gained access to the RCON<br>
password<br>
for my CoD2 server.<br>
> Apparently, they were able to use the client<br>
auto-download functionality to<br>
> download my server configuration, which I<br>
(stupidly) had named "server.cfg".<br>
><br>
> So a word to the wise - name your server<br>
config<br>
in such a way that nobody<br>
> can guess what it is. This is a Q3 engine<br>
bug,<br>
so the whole series is<br>
> affected.<br>
> --<br>
> Geoff Goas<br>
> Network Engineer<br>
><br>
><br>
_______________________________________________<br>
> cod mailing list<br>
> <a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br></div></div>
<mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>>><div class="im"><br>
<br>
> <a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br></div>
<mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>>><div class="im"><br>
<br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
<br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br></div>
<mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>>><div class="im"><br>
<br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
<br>
<br>
<br>
-- Geoff Goas<br>
Network Engineer<br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br></div>
<mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>>><div class="im"><br>
<br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
<br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br></div>
<mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>>><div class="im"><br>
<br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
<br>
<br>
<br>
-- Geoff Goas<br>
Network Engineer<br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br></div>
<mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>>><div class="im"><br>
<br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
<br>
------------------------------------------------------------------------<br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a> <mailto:<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a>><br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
<br>
<br>
<br>
-- <br>
Geoff Goas<br>
Network Engineer<br>
------------------------------------------------------------------------<br>
<br>
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a><br>
</div><div class="im"><a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
<br>
</div></blockquote><div><div class="h5">
_______________________________________________<br>
cod mailing list<br>
<a href="mailto:cod@icculus.org" target="_blank">cod@icculus.org</a><br>
<a href="http://icculus.org/mailman/listinfo/cod" target="_blank">http://icculus.org/mailman/listinfo/cod</a><br>
</div></div></blockquote></div><br>