The Unreal Admins Page - Forums

The Unreal Admins Page - Forums (https://unrealadmin.org/forums/index.php)
-   UT2003/4 Server - Windows Specific (https://unrealadmin.org/forums/forumdisplay.php?f=109)
-   -   Help with a Crash, has somthing to do with Voice Chat. (https://unrealadmin.org/forums/showthread.php?t=27518)

DazzaJay 13th September, 2008 04:28 PM

Help with a Crash, has somthing to do with Voice Chat.
 


As you can see from the Screenshot above, its a error caused by Voice chat. this is not the first time this error has happened, its happend quite a lot recently. Nothing new that i can think of has been added to the server, and it just started occouring without warning.

The strangest thing is, i have even disabled voice chat in the server (by use of the tick box in the web admin interface) and the error still occours.

I have no idea why its happening, or whats causing it, or how to fix it.

Any ideas / soloutions would be greatly appreiceated.

:::EDIT:::
I just saw it happen again. No players were in the server, and no custom mutators other than antiTCC were running.

Mc.Gugi 14th September, 2008 11:18 AM

Crash-Exploit
:-/

AnthraX 14th September, 2008 01:35 PM

http://utgl.unrealadmin.org/UT2004/V...v3369-Windows/

haven't tested it much. Let me know if it works for you

Shambler 14th September, 2008 02:48 PM

Posted this fix on the UT2004 mailing list (Win32 only), though I guess there aren't many people still on that list:
http://download.beyondunreal.com/fil...xploit-fix.zip (thanks to Haarg at BU for uploading).

That's tested and works, feel free to pass the link on to other UT2004 admins, though please don't have it posted on news sites.

DazzaJay 14th September, 2008 05:02 PM

Thanks guys. i will install it soon. i would have also posted a link to this thread in Atari's forums about this issue as it seems lots of people have it, but the thread was locked for no reason. :-S

(ODC) Gailieo 14th September, 2008 05:22 PM

Linux
 
Anyone have a patch for Linux systems?

If your iptables is updated you can add the following:

########### Detect ut2004null
echo detect ut2004null
echo
# ${IPTABLES} -A INPUT -i ${WAN_IF} -p udp --dport 7777 -m length --length 40 -m string --algo bm --hex-string '|000001082000|' -j LOG --log-prefix "UT2004 Remote DoS " --log-level 4

########## Defend ut2004null
echo defend ut2004null
echo
# ${IPTABLES} -A INPUT -i ${WAN_IF} -p udp --dport 7777 -m length --length 40 -m string --algo bm --hex-string '|000001082000|' --from 27 --to 33 -j LOG --log-prefix "UT2004 Remote DoS " --log-level 4

Naked_Ape 14th September, 2008 09:32 PM

I think Gailieo meant
Code:

# ${IPTABLES} -A INPUT -i ${WAN_IF} -p udp --dport 7777 -m length --length 40 -m string --algo bm --hex-string '|000001082000|' --from 27 --to 33 -j DROP
on the second line otherwise the packet is only logged but not blocked.

DazzaJay 14th September, 2008 10:46 PM

I think ive now gaught the el-bastardo in the act of trying to crash my server (which ofcourse isnt crashing thanks to your fix Shambler)

Once every 5 minutes, a connection is made to the server that the server shows in the window (as seen below)
Same IP, and always for one second.



I have done a Trace and its a Hungarian.
The little Turd has been doing it for hours now.
because of how long its been doing it, and its close to once every 5 minutes, id say the turd has an automated app running trying to crash servers.

Code:

NeoTrace  Version 3.25  Trace Results
Target: 89.134.227.144
Date: 9/15/2008 (Monday), 7:45:44 AM
Nodes: 22

Node Data
Node Net Reg IP Address      Location            Node Name
  1  -  - 66.79.171.237  Hayward            POTHOLE
  2  1  - 66.79.171.209  Hayward           
  3  1  - 205.209.190.157 Hayward            sj-mainrouter.us.coreisp.nl
  4  2  1 208.178.60.81  Sunnyvale          po1.410.ar1.snv2.gblx.net
  5  3  1 67.17.107.34    San Jose            ge2-1-10g.ar2.sjc2.gblx.net
  6  4  2 4.68.111.161    San Jose            te-9-4.car4.sanjose1.level3.net
  7  4  2 4.68.18.62      San Jose            vlan69.csw1.sanjose1.level3.net
  8  4  2 4.69.134.241    San Jose            ae-64-64.ebr4.sanjose1.level3.net
  9  4  2 4.69.135.186    New York            ae-2.ebr4.newyork1.level3.net
  10  4  2 4.69.132.93    WASHINGTON D.C.    ae-3.ebr4.washington1.level3.net
  11  4  2 4.69.134.178    WASHINGTON D.C.    ae-64-64.csw1.washington1.level3.net
  12  4  2 4.68.17.5      WASHINGTON D.C.    ae-13-69.car3.washington1.level3.net
  13  4  2 4.79.168.202    WASHINGTON D.C.    upc-broadba.car3.washington1.level3.net
  14  5  3 213.46.190.189  WASHINGTON D.C.    us-was02a-rd1-10ge-3-0.aorta.net
  15  6  3 213.46.160.169  WASHINGTON D.C.    fr-par02a-rd1-pos-13-0-0.aorta.net
  16  7  3 213.46.163.2    PARIS              fr-par02a-rd2-ge-0-0.aorta.net
  17  6  3 213.46.160.217  Unknown            de-fra01a-rd2-pos-12-0.aorta.net
  18  6  3 213.46.160.129  BUDAPEST            hu-bud02a-ra2-so-4-0-0-0.aorta.net
  19  8  3 213.46.166.42  BUDAPEST            upc-hu-gw2.aorta.net
  20  9  - 195.184.170.198 BUDAPEST           
  21  -  - 0.0.0.0        Unknown            No Response
  22  10  4 89.134.227.144  BUDAPEST            catv-89-134-227-144.catv.broadband.hu

Packet Data
Node High Low  Avg  Tot  Lost
  1    0    0    0    1    0
  2    1    0    0    7    0
  3  155    0  24    7    0
  4    5    1    2    7    0
  5  38    2    9    7    0
  6    6    2    3    7    0
  7  17    3    8    7    0
  8  15    4  11    7    0
  9  83  74  76    7    0
  10  93  80  86    7    0
  11  92  83  88    7    0
  12  118  80  85    7    0
  13  82  80  80    7    0
  14  81  79  80    7    0
  15  162  161  161    7    0
  16  156  149  151    6    0
  17  165  157  159    6    0
  18  184  168  174    6    0
  19  178  164  172    6    0
  20  188  187  187    6    0
  21 ---- ---- ----  12  12
  22  205  193  196    6    0

Network Data
Network id#: 1

OrgName:    Managed Solutions Group, Inc.
OrgID:      MSG-48
Address:    45535 Northport Loop East
City:      Fremont
StateProv:  CA
PostalCode: 94538
Country:    US

Network id#: 2

OrgName:    Global Crossing
OrgID:      GBLX
Address:    14605 South 50th Street
City:      Phoenix
StateProv:  AZ
PostalCode: 85044-6471
Country:    US

Network id#: 3

OrgName:    Global Crossing
OrgID:      GBLX
Address:    14605 South 50th Street
City:      Phoenix
StateProv:  AZ
PostalCode: 85044-6471
Country:    US

Network id#: 4

OrgName:    Level 3 Communications, Inc.
OrgID:      LVLT
Address:    1025 Eldorado Blvd.
City:      Broomfield
StateProv:  CO
PostalCode: 80021
Country:    US

Network id#: 5
UPC Broadband
  Internet Services
  Erlachgasse 116
  A-1100 Vienna
  Austria

Network id#: 6
UPC Broadband
  Internet Services
  Erlachgasse 116
  A-1100 Vienna
  Austria

Network id#: 7
UPC Broadband
  Internet Services
  Erlachgasse 116
  A-1100 Vienna
  Austria

Network id#: 8
UPC Broadband
  Internet Services
  Erlachgasse 116
  A-1100 Vienna
  Austria

Network id#: 9
UPC Magyarorszag Kft
  Kinizsi 30-36
  H-1092 Budapest
  Hungary

Network id#: 10

OrgName:    RIPE Network Coordination Centre
OrgID:      RIPE
Address:    P.O. Box 10096
City:      Amsterdam
StateProv: 
PostalCode: 1001EB
Country:    NL


Registrant Data
Registrant id#: 1
See Registrant Pane for registrant contact information.

Registrant id#: 2
See Registrant Pane for registrant contact information.

Registrant id#: 3
See Registrant Pane for registrant contact information.

Registrant id#: 4
See Registrant Pane for registrant contact information.
_____
NeoTrace Copyright ©1997-2001 NeoWorx Inc
48cd8600
da 43


frisp 15th September, 2008 12:42 AM

Quote:

Originally Posted by (ODC) Gailieo (Post 142114)
Anyone have a patch for Linux systems?

http://utgl.unrealadmin.org/UT2004/V...xploit-fix.zip

Shambler 15th September, 2008 12:39 PM

One thing to note, is that the IP 'might' not be real, since the exploit can be performed using UDP packets with a spoofed IP; all the same though, it may be worth sending a few emails to the ISP abuse address, from the whois result on the IP.

DazzaJay 15th September, 2008 01:03 PM

well, ive now seen 3 different IP's all traces have shown they are on the same ISP in Hungary.

Sgt.Muffin 17th September, 2008 03:22 AM

Is there going to be a patch for the UT2004 Demo or is that even possible? We have one demo server that we would like to open up again.

ARsEnAl51 17th September, 2008 05:57 AM

Imo, you can forget about it... :/

AnthraX 17th September, 2008 12:33 PM

Quote:

Originally Posted by Sgt.Muffin (Post 142243)
Is there going to be a patch for the UT2004 Demo or is that even possible? We have one demo server that we would like to open up again.

http://utgl.unrealadmin.org/UT2004/V...x/v3334-Linux/

This one should work for the demo (linux version).

Alfred Gore 17th September, 2008 02:01 PM

Quote:

Originally Posted by Sgt.Muffin (Post 142243)
Is there going to be a patch for the UT2004 Demo or is that even possible? We have one demo server that we would like to open up again.

Well, I successfully applied the patch to our windows 3334 demo server. I checked the patch out pretty thoroughly (hex editor) before and after I applied it to the engine.dll. Additonally, I did the patch on my personal machine, not on the server, just to be safe. It's on our server now, running with no issues since last night.

I would be happy to email you the patched 3334 Engine.dll, or if someone knows how to put it on here for download...

-Al Gore

Al Gore's PATCHED Nobel Prize Winning Throbbin House O' Pain
UT 2004 Onslaught Torlan Demo Server
208.0.37.87
All Torlan, all the time.

DazzaJay 17th September, 2008 02:10 PM

Quote:

Originally Posted by Alfred Gore (Post 142267)
I would be happy to email you the patched 3334 Engine.dll, or if someone knows how to put it on here for download...

I can host it on potholestudios.com if you want.
You can even hotlink to it :-)

Alfred Gore 17th September, 2008 02:29 PM

Quote:

Originally Posted by DazzaJay (Post 142268)
I can host it on potholestudios.com if you want.
You can even hotlink to it :-)

DazzaJay,

I just e-mailed the patched engine.dll to you. If you could put a link on here for folks, that would be great!

Thanks much

-Al

DazzaJay 17th September, 2008 02:34 PM

its for the Demo server Correct? (just need to make sure it goes in the correct section of downloads)
And its a Fix for the Voice Crash Exploit right?

Alfred Gore 17th September, 2008 02:37 PM

Quote:

Originally Posted by DazzaJay (Post 142270)
its for the Demo server Correct? (just need to make sure it goes in the correct section of downloads)
And its a Fix for the Voice Crash Exploit right?

Windows Demo version 3334 (server/client) fix for the Voice Crash Exploit.

DazzaJay 17th September, 2008 02:38 PM

it wil be up in about 20 mins, just writing a readme for it.
iil post the link in a sec.


All times are GMT +1. The time now is 03:08 PM.

 


All pages are copyright The Unreal Admins Page.
You may not copy any pages without our express permission.