Enemy Territory 2.60b "Patch"

#1

Found it on

http://www.new-etmaps.de/modules.php?name=New_Maps

http://www.idsoftware.com/

Im noob so I dont know anything really. So read this thread to hopefully get some info on this subject.

From readme.txt

CVE-2006-2082: directory traversal / information leak in Quake III Arena auto download feature

Ludwig Nussel and Thilo Shulz discovered a vulnerability letting a malicious client download files from a server if auto download is enabled ( sv_allowDownload 1 ).

Issue #2 ( CVE pending ): R_RemapShaders buffer overflow

A second issue fixed in this release would let a malicious server exploit a buffer overflow to execute a shellcode on connecting clients.

–
Updated binaries for the following games are available:

Quake III Arena - fixed at version 1.32c
Return To Castle Wolfenstein - fixed at version 1.41b
Wolfenstein: Enemy Territory - fixed at version 2.60b

If you run a server with any older version, please upgrade or consider turning off autodownload ( set sv_allowDownload to 0 ). Wolfenstein: Enemy Territory servers http/ftp download feature is not affected by CVE-2006-2082. If you don’t wish to upgrade, you can decide to only enable http/ftp downloads and disable legacy downloads in that particular case.

Finally, server administrators should note that game servers should be running in restricted environments as much as possible ( unpriviledged accounts and chroot jails ). It’s a good thing to do the same for clients, or at least ensure that you are properly firewalled.

(Floris) #2

ETPRO does not work with this patch yet… :frowning:

I modified the patch selector by rob and killerwhale a bit to allow switching between 2.55, 2.56, 2.60 and 2.60b! :wink:

Instructions: Drag all the files into your ET folder and rename the .txt to .bat

Rapidshare:
http://rapidshare.de/files/19994005/patchselector260b.zip.html

#3

Ok, try a clean install without pathselector?

(SCDS_reyalP) #4

2.60b on the server should be ok. If you use it on the client, etpro will kick you for integrity.

#5

Ok, I renamed this thread to “Enemy Territory 2.60b SERVER Patch” to clarify.

(P4nth3r) #6

When will the ETPRO update be ready??

Greetz Panther

(kamikazee) #7

So the question should rather be: How long before all servers make the switch?

#8

So the question should rather be: How long before all servers make the switch?[/quote]

Why do you wonder that? The server-fix “2.60b” works with ET clients with patch 2.60.

I mean, server-admins just need to upgrade. Its not like 2.55 vs 2.60 servers where you can only get 2.55 or 2.60 players depending what server you run, or what patch you have.

(P4nth3r) #9

So if both server and client have 2.60b, ETPro will work just fine??

Greetz Panther

#10

You mean the server you play on?

Then no. Nope, just ignore this patch, and you will be able to play on both 2.60 and 2.60b servers that has etpro.

If you want to host a dedicated server, it could be a good idea to install the 2.60b on the server.

(P4nth3r) #11

Why didn’t they inform everybody that it’s server side only??
Now everybody get’s confused =/

thnx JBRAA

Greetz Panther

(Floris) #12

It’s a server side patch? That’s makes no sense lol, server admins who want to fuck your pc just don’t install the patch then.

#13

Why doesnt it make any sense?

(P4nth3r) #14

It doesn’t make sence becuase of this:

If I would be a server admin that would want to abuse this leak, I just wouldn’t install the patch.
As simple as that =/

That is the same thing as making a virus scanner for a trojanhorse user =/

Greetz Panther

(uber_noob) #15

It’s actually two patches:

One is serverside for the exploit with auto downloads.

One is clientside for the buffer overflow exploit.

No serverside patch can prevent buffer overflow exploits on the client. You can always modify the packets after the server has sent them, but before they reach the client.

(Jaquboss) #16

yep topic should be renamed as well :slight_smile:

#17

Removed

(nUllSkillZ) #18

Still confused.

There are the following possibilities:

[ol]
[li]unmodded
[/li][list=a:bf97332add]
[li]patched server + unpatched client
[/li][li]unpatched server + patched client
[/li][li]patched server + patched client
[/li][/ol]
[li]modded (ET-PRO, ET-PUB, …)
[/li][list=a]
[li]patched server + unpatched client
[/li][li]unpatched server + patched client
[/li][li]patched server + patched client
[/li][/list]
[/list:o:bf97332add]

Which one’s are working?
I’ve marked some combinations due to the info’s above (if I get this correct).

(SCDS_reyalP) #19

No. ETPro will kick all 2.60b clients, no matter what.

(P4nth3r) #20

Arggg… oh well, what I really dont understand is: Why the F#ck did it take them 7 years to find out about this bug/leak =/