POTENTIONAL FIX: etded.x86 getstatus exploit Options

[Guest_Dutchman_*]

Hi,

since a few months there is a exploit floating around abusing the getstatus requests to launch dos attacks against random targets and as a side effect creating massive lags on clients and the server.
Cause of this Yada from Staatsschutz.org made a patch for linux wich reduces the effectivity of this exploit.

etfix_getstatus 0.2 by yada / staatsschutz.org / jan. 2011
------

This patch will ratelimit etded.x86 2.60b getstatus requests to 1 per IP every
4 seconds. This approach is not ideal as the real fix would be to change the
protocol to require some kind of handshake but this would break compatibility
with existing clients so its not really practical. The worst part is that the
patch is (in theory) vulnerable to a dos where legitimate clients could be
denied access to the getstatus command but i feel this is less of a headache
than kiddies using the server to flood random targets and thereby lagging the
server and pushing bandwith usage through the roof (master server is excluded
from ratelimit so no need to worry about it being denied using spoofed
packets).

Download the file right here.

A readme.txt, the sourcecode and a small howto are included.

Your free to distribute this file.

This post has been edited by Dutchman: Jan 6 2011, 11:33 AM

[AmericanPie1979]

Dutchman :) thx for info but i have 2.55+ so all patches can connect 2.55 - 2.60b


it would be great when the patch works on this one too :)

etded.x86


Gruss von Opa :)


:P

This post has been edited by AmericanPie1979: Oct 19 2011, 03:31 PM

[Guest_Dutchman_*]

I don't know wich etded.x86 version you have "hochgeladen" but i ran the patch on your etded.x86 without any problems:

CODE

et@*******:~$ ./etfix_getstatus etded.x86
------------------------------------------------
** limit getstatus patch 0.2 for etded.x86 2.60b
           yada // staatsschutz.org // jan. 2011
------------------------------------------------
Patching: 23 bytes at offset 71BC0.
Patching: 117 bytes at offset 71BE0.
Patching: 11 bytes at offset E4EF.
Patching: 5 bytes at offset E507.
Patching: 4 bytes at offset 10C13.
Success: etded.x86 patched.

So ,you should patch it on your linux box and try it. If you don't know how to do it, we can help:)

This post has been edited by Dutchman: Oct 19 2011, 03:49 PM