Title: Valve Software Half-Life Dedicated Server Information Disclosure/DOS Vulnerability
Severity: MODERATE
Description:
Half-Life is a game distributed and maintained by Valve Software. It includes a dedicated game server component that allows multiple users to game across a network. The game engine is used in many modifications.
Half-Life dedicated server has been reported prone to an information disclosure vulnerability. This issue may also be exploited to deny service to legitimate users of the Half-Life dedicated server.
The issue presents itself due to a flaw in download functionality that is provided by the Half-Life dedicated server. Normally this type of functionality would be employed by the server to push new game 'maps' out to gamers who connect to a server. It has been reported however, that a malicious attacker may exploit this functionality to download any file from the root folder of the current running game type, or from the valve folder. This may enable an attacker to download and disclose server configuration files or other files stored in an accessible folder that may contain potentially sensitive information.
Additionally it has been reported that an attacker may download any large file to trigger a violation in the vulnerable servercausing it to crash, this may effectively deny service to legitimate users.
It should be noted that 'allowdownload' must be enabled in the Half-Life dedicated server configuration files for this issue to exist. This issue has been reported to affect all versions of the Half-Life dedicated server.
Affected Products:
- Valve Software Half-Life 1.1.0.0.4 Linux
- Valve Software Half-Life 1.1.0.0.4 Windows
- Valve Software Half-Life 1.1.0.0.8
- Valve Software Half-Life 1.1.0.0.9
- Valve Software Half-Life 1.1.1.0
- Valve Software Half-Life Dedicated Server 3.1.0
- Valve Software Half-Life Dedicated Server 3.1.0.0.4 Linux
- Valve Software Half-Life Dedicated Server 3.1.0.0.5 Linux
- Valve Software Half-Life Dedicated Server 3.1.0.0.6 Linux
- Valve Software Half-Life Dedicated Server 3.1.0.0.7 Linux
- Valve Software Half-Life Dedicated Server 3.1.0.0.8 Linux
- Valve Software Half-Life Dedicated Server 3.1.0.0.9 Linux
- Valve Software Half-Life Dedicated Server 3.1.1.0 Linux
- Valve Software Half-Life Dedicated Server 3.1.1.1c1 Linux
- Valve Software Half-Life Dedicated Server 3.1.1.1d Linux
- Valve Software Half-Life Dedicated Server 3.1.3
- Valve Software Half-Life Dedicated Server 4.1.0.0.4 Win32
- Valve Software Half-Life Dedicated Server 4.1.0.0.6 Win32
- Valve Software Half-Life Dedicated Server 4.1.0.0.7 Win32
- Valve Software Half-Life Dedicated Server 4.1.0.0.8 Win32
- Valve Software Half-Life Dedicated Server 4.1.0.0.9 Win32
- Valve Software Half-Life Dedicated Server 4.1.1.0 Win32
- Valve Software Half-Life Dedicated Server 4.1.1.1c1 Win32
References:
- Valve Software: Valve Software Homepage
- counter-strike.net: Update for CS 1.5 server (WIN & LINUX)
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
