Duplicate CSAY can be (ab)used to kill a whole server

[u4704]

This is a serious vulnerability. Any logged in admin can crash the whole server by entering a very long csay string which is separated by "\"s.

csay Hello, this is a test\which might crash the whole server\or disconnect all users\with a segment violation error.\This is a real problem\which should be fixed.

Works for me. That's the problem. I can reproduce the bug without any problems. If a SRB2 developer needs the password for my 24/7 server to test the bug, contact me via PM.

 

[WedgeStratos]

This is an age-old bug that's existed for a long time. Only way to rid of it is to rid of the command altogether, or maybe disable use of certain keys. Some EXE mods have managed to fix this exploit, but the main client hasn't bothered to adopt it.

 

[u4704]

In netgames, the "age-old bug" becomes a age-old unfixed security vulnerability. Fixing this should be a highest-priority task.

 

[Eblo]

Only those logged in as admin can do this. The solution? Don't give admin to people that will abuse it.

 

[Mystic]

I wouldn't call a bug that requires you to be a logged in administrator to trigger a serious security vulnerability. It should totally be fixed but it's not a big deal if you need access rights to do it. Someone with access rights to your server can ruin the server in all sorts of ways, after all.