[Release] unreliable-adv security patch

[AnthraX]

This patch stops the servercrashes caused by the exploit tool I linked to in the top post.

[-=V@STV$T=-]

Cool so the exploit that crashes one server with another server like darkelarious told me is now covered [stopped]?

[AnthraX]

I have no idea which one that would be. This simply stops the exploit I linked to.

[-=V@STV$T=-]

NEW-exploit- a new one i guess ,wich only darkelarious knows i think ,beside the remote admin exploit wich have never bin fixed not even on patch 451a/b so thats the trigger for guys to make new ones, he says that his not effects patch 451 but i know him longer than today ,profesional guys like him never tell the secrets but it are nasty ones ican tell u, this is not used from inside the server of the victim but used outside another victims server is used to crash the headvictim with it and noone will even know who did it so i guess its an hack somehow with ddos or whatever ,
i only know that its an script that has to run on on a server but might as well be an web server or something




OLD/exploit-The remote admin exploit wich is a problem now for few years is still not fixed but this doesnt compair with the remote crash script/tool but adventually they should be both fixed, the fix i have for remote admin exploit is to use other ports than 80 ,8080 or 8888 and to use the command from utconsole and do "admin set uweb.webserver benable <True/False>" just disable it [False] and than they cannot see the admin pass for console wich is in the remote adminpass under server settings,ones the yhave that all is lost and they can do what ever they like to server but this solution is not an exploit fix it is an bandage arround an big wound.

[iDeFiX]

Appreciated, AnthraX

[BlackWolf]

Hmm even with that fix the server can be crashed (4.51)
And 4.36 can be crashed and is not immune
Tested with the tool from the first post.

Nothing we can do ?

Wolfi

[back4more]

^ posting your relevant ucc/server.log files would probably assist in what is happening.

[BlackWolf]

Critical: appError called:
Critical: Assertion failed: NumInRec<=RELIABLE_BUFFER [File:C:\UTDev\Engine\Src\UnChan.cpp] [Line: 262]
Exit: Executing UObject::StaticShutdownAfterError

With the tool from the first post.
tested with UT version 4.36 and patched 4.51

[(G)ott]

I just wanted to update the link because the old one is down

unreliable-adv-patch.zip (by unrealtournament.99.free.fr)

[xen]

You should correct your start post:

436 on Linux is immune, 436 on Windows is not.

[Letylove49]

use UT436 for a server is not a good idea because the webadmin doesnt' work correctly.

[xen]

Originally Posted by Letylove49

use UT436 for a server is not a good idea because the webadmin doesnt' work correctly.

WebAdmin works fine here on both Linux and Windows.

[maggi]

Did anybody find a solution for STOP crashing server though the server is patched?

[thyrex]

Just patched my server wich was vulnerable !
Works like a charm, TY.

[50BMG]

Is this solution now defunct? (The download link doesn't seem to work any longer)

I'd be interested in checking this out if anyone still has a copy.

UPDATE:
Maybe it's me... can't seem to download ACE either.

[back4more]

to answer both Q's in one go hopefully ..

> ADV Patch

> ACE8H

*for ServerCrashFix.. search below;

*any other files you need , as there's no alternative currently: http://unrealtournament.99.free.fr/utfiles/

*also here: http://utdatabase.99k.org/ , however no search function.

[50BMG]

Ok - Thanks. I had found them there when I couldn't find em here. Glad to know they're authentic.

So I take that to mean - this is still a valid patch - even with the current ACE and ServerCrash fix (which is in ACE now).

Excellent.

[back4more]

yep the adv patch is important . as for the servercrashfix in ace iam not sure but most likely.