Bug#681812: openarena-server: segfaults when a client is requesting a callvote to kick another player

2012-09-14 Thread Simon McVittie
severity 681812 serious
thanks

On Mon, 16 Jul 2012 at 20:54:41 +0200, Markus Koschany wrote:
 1. Join the server and open the ingame console with Shift+ESC or ~.
 2. Ask for a vote to kick a non-existing player on the server like
 
 \callvote kick pullo
 
 if pullo is a player who does not play on the server.

Hi, sorry for the delay in responding to this. Thank you both for your help
with this bug.

This is a DoS that remote unauthenticated users can trigger on-demand, so
I've bumped the severity up and am preparing an upload.
I'll ask for a freeze exception for it.

Regards,
S


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#681812: openarena-server: segfaults when a client is requesting a callvote to kick another player

2012-07-16 Thread Markus Koschany
Package: openarena-server
Version: 0.8.8-5
Severity: normal

Dear Maintainer,

as i have hinted in my last report to #664637, there are at least two
different kind of bugs which can lead to a server crash.

This one is reproducible with Debian's standard configuration. 

*How to reproduce the crash?*

1. Join the server and open the ingame console with Shift+ESC or ~.
2. Ask for a vote to kick a non-existing player on the server like

\callvote kick pullo

if pullo is a player who does not play on the server.

3. Result: Segmentation Fault and server crash

The crash always occurs if the callvote name differs from the actual player
names.

If you ask for a callvote and if you leave the field for the player
name blank, then the following message can be found in the log file.

NET_CompareBaseAdr: bad address type

As far as i can tell the clientkick id-command, which you can use
from the ingame menu, works as intended. 

*Quick solution*

Disable the vote option to kick a player from the server in
/etc/openarena-server/server.cfg. The default value is:

set g_voteNames 
/map_restart/nextmap/map/g_gametype/kick/clientkick/g_doWarmup/timelimit/fraglimit/shuffle
 

If you remove kick from the line the callvote option to kick another
player is disabled and nobody can crash the server anymore.

set g_voteNames 
/map_restart/nextmap/map/g_gametype/clientkick/g_doWarmup/timelimit/fraglimit/shuffle
 

*Attachments*

I've attached my debug log files and the backtrace from gdb. It seems
that the if-condition in code/game/g_cmds.c line 1818 is never true
although the player doesn't exist. Somehow the server doesn't check
carefully enough if a player exists or not. 

Kind regards
Markus Koschany

-- System Information:
Debian Release: 6.0.5
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.0.24 (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages openarena-server depends on:
ii  adduser   3.112+nmu2 add and remove users and groups
ii  ioquake3-server   1.36+svn2287-1 Standalone server for ioQuake3 bas
ii  libc6 2.11.3-3   Embedded GNU C Library: Shared lib
ii  openarena-081-maps0.8.5split-2   OpenArena game data - maps from 0.
ii  openarena-081-misc0.8.5split-2   OpenArena game data - miscellaneou
ii  openarena-081-players 0.8.5split-2   OpenArena game data - player graph
ii  openarena-081-players-mat 0.8.5split-2   OpenArena game data - mature pla
ii  openarena-081-textures0.8.5split-2   OpenArena game data - textures fro
ii  openarena-085-data0.8.5split-2   OpenArena game data - 0.8.5 update
ii  openarena-088-data0.8.8-1OpenArena game data
ii  openarena-data0.8.5-3OpenArena game data

openarena-server recommends no packages.

openarena-server suggests no packages.

Versions of packages ioquake3-server depends on:
ii  libc6   2.11.3-3 Embedded GNU C Library: Shared lib
ii  zlib1g  1:1.2.3.4.dfsg-3 compression library - runtime

-- Configuration Files:
/etc/default/openarena-server changed [not included]
/etc/init.d/openarena-server changed [not included]
/etc/openarena-server/server.cfg changed [not included]

-- no debconf information


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#681812: openarena-server: segfaults when a client is requesting a callvote to kick another player

2012-07-16 Thread Markus Koschany


openarena_server_debug.tar.gz
Description: GNU Zip compressed data


signature.asc
Description: OpenPGP digital signature