1 Topic by heinrich5991 (edited by heinrich5991 2016-11-14 00:35:02)

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Topic: 0.6.4 released - another security fix

As with the 0.6.3 release, a reported security vulnerability motivated this release: This time, the security vulnerability is worse, attacker controlled memory-writes and possibly arbitrary code execution on the client, abusable by any server the client joins.

The changelog:
Bug fixes

  • Fix the above-mentioned security vulnerability in the client (ff25472).

  • Fix a read of uninitialized memory that is sent over the network, from the server (7dd463d).

  • Fix decoding of overlong UTF-8 sequences to non-invalid code points, leading to possible duplicate names (#1373, 205dbce).

  • Drop connected packets that come from a formerly connected server in the client (#1356, 2057808).

  • Use a different port for connless messages, increasing the difficulty of successful IP spoofing (7c43b76).

  • Make spoofing of server info packets harder (8af77b6).

  • Fix spoofing for vital chunks, and require most chunks to be vital (f457b58).

Other  changes

  • Sort by player count by default, instead of server name (1b2a91f).

  • Add a cooldown on unpause (#1365, 56e366a).

Go download it now!

2 Reply by mkjol

  • mkjol
  • mkjol
  • New member
  • Offline

Re: 0.6.4 released - another security fix

Great to hear that! But how to add that cooldown? tongue

Official iF|City Discord Server
iF|City Youtube Channel

3 Reply by Quatria

  • Quatria
  • Quatria
  • Member
  • Offline

Re: 0.6.4 released - another security fix

So you are saying that a server can make the old client to execute code? So you join a server and have a virus? wow

heinrich59991 wrote:

Sort by player count by default, instead of server name.

awsome

4 Reply by Henningstone

  • Henningstone
  • Henningstone
  • Member
  • Offline

Re: 0.6.4 released - another security fix

Someone should mention that it breaks some Client → Server compatibility with older versions, so don't be surprised if you suddenly can't join some servers anymore. It's not a bug, it's a feature wink

5 Reply by necropotame

  • necropotame
  • Member
  • Offline

Re: 0.6.4 released - another security fix

Can you detail this ? Is 0.6.3 client can join a 0.6.4 server, and a 0.6.4 client can join a 0.6.3 server, or even that is not possible ?

6 Reply by Henningstone (edited by Henningstone 2016-11-13 19:40:58)

  • Henningstone
  • Henningstone
  • Member
  • Offline

Re: 0.6.4 released - another security fix

0.6.3 client can join 0.6.4 server apparently, no problem here. Even many servers were updated to 0.6.4 way before it was released.

But if you try to do it the other way around, you may face some problems (see this discussion)

TL;DR: with a 0.6.4 client, you might not be able to join 0.6.3 servers

7 Reply by jxsl13 (edited by jxsl13 2016-11-13 19:44:50)

  • jxsl13
  • jxsl13
  • Member
  • Offline

Re: 0.6.4 released - another security fix

Great, let's hope sushi updates his client ._.
me gusta big_smile

I hope the vanilla client will implement some more options to disable HUD elements and sounds , e.g. chat, server msg, hearts, shield, broadcast and so on..

Teeworlds [ friends ] clan
Some YouTube Stuff about Teeworlds

8 Reply by Redix

  • Redix
  • New member
  • Offline

Re: 0.6.4 released - another security fix

There should not be any problems with unmodified versions of the game. The only incompatibility I know about is with the fast-download feature of DDNet and as mentioned many times... mods are not officially supported.

9 Reply by necropotame

  • necropotame
  • Member
  • Offline

Re: 0.6.4 released - another security fix

Is it possible to detect the version of the client ? I mean, by some indirect way.

10 Reply by Schwertspize

  • Schwertspize
  • Member
  • Offline

Re: 0.6.4 released - another security fix

You can send them malicious code that sends you an immediate response I think... If the code is executed, it's not 0.6.4

Having troubles finding servers in the serverlist? Go to Pastebin (its a referer cause there is daily a new pastebin) and add the lines to your settings.cfg (in %APPDATA%\teeworlds). Then open teeworlds and go to the favorites tab. (Note however, standard teeworlds client can only show 256 favorites, use ddnet instead)

11 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: 0.6.4 released - another security fix

Schwertspize wrote:

You can send them malicious code that sends you an immediate response I think... If the code is executed, it's not 0.6.4

It's probably not that easy to execute arbitrary code. ^^

12 Reply by Neox (edited by Neox 2016-11-14 00:23:59)

  • Neox
  • Neox
  • Donor
  • Offline

Re: 0.6.4 released - another security fix

I don't see new commits - What code do we need to change?
Is it the commit from 9 days ago?

while(!Success())
    TryAgain();
Try until you succeed.

13 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: 0.6.4 released - another security fix

Neox wrote:

I don't see new commits - What code do we need to change?
Is it the commit from 9 days ago?

Yes. I added links to the relevant commits in the first post of this topic.

14 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: 0.6.4 released - another security fix

Fixed the Windows version, it previously required MinGW's standard library to be installed.

EDIT: Please tell me if the versions do or do not work! Once per OS should suffice. smile

15 Reply by Neox

  • Neox
  • Neox
  • Donor
  • Offline

Re: 0.6.4 released - another security fix

Oh wow, the textures are pretty weird with 0.6.4. At least for the laser one. You can look at it really quickly by going to nx-lab.com:8310, look at the giant dollar (you can see it even if you're a spectator)

while(!Success())
    TryAgain();
Try until you succeed.

16 Reply by Pathos

  • Pathos
  • Member
  • Offline

Re: 0.6.4 released - another security fix

heinrich5991 wrote:

Other  changes

  • Sort by player count by default, instead of server name (1b2a91f).

  • Add a cooldown on unpause (#1365, 56e366a).

Why not sort by ping?

Also, there's still a bug where when the game is paused and everybody leaves with tournament mode set to 1, nobody can join as a player to vote to unpause the game.

In the future, is it better to make bug reports in the Github directly? There are so many bug reports in the forum, but my guess is that it's a lot of digging for the devs.

Learn to move faster
Set up TW server on Pi  :: Vanilla/TW+ server configs :: Vanilla maps

17 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: 0.6.4 released - another security fix

Pathos wrote:

Also, there's still a bug where when the game is paused and everybody leaves with tournament mode set to 1, nobody can join as a player to vote to unpause the game.

In the future, is it better to make bug reports in the Github directly? There are so many bug reports in the forum, but my guess is that it's a lot of digging for the devs.

Yes, it is more useful to report to Github if you can.

18 Reply by heinrich5991

  • heinrich5991
  • heinrich5991
  • Moderator / Donor
  • Offline

Re: 0.6.4 released - another security fix

Henningstone wrote:

Someone should mention that it breaks some Client → Server compatibility with older versions, so don't be surprised if you suddenly can't join some servers anymore. It's not a bug, it's a feature wink

This should be a fix: PR#591 for ddnet/ddnet.

19 Reply by Captain AMN

  • Captain AMN
  • Captain AMN
  • Member
  • Offline

Re: 0.6.4 released - another security fix

Thank you very much for the update!

*** JUSTICE ALWAYS WINS ***

20 Reply by canticumludio

  • canticumludio
  • New member
  • Offline

Re: 0.6.4 released - another security fix

That update was a hard pain for me... Especially because this version is pulled by Steam.
I was not able to play any custom maps yikes
The ingame downloader was always at 0 kb / x kb ...
Manual download of the maps dont works either. neutral
Moved the map with correct name in the "downloadedmaps" folder and restart the game, but
the console said:
"couldn't load the whole thing, wanted x got 0"

(x = size of map)
I downloaded teeworlds 0.6.3 and replaced only the teeworlds.exe in my steam/teeworlds folder and now everything works fine .________.

21 Reply by sytestorm

  • sytestorm
  • New member
  • Offline

Re: 0.6.4 released - another security fix

How about fixing a DDOS protection? You can't even block anymore without noobs raging and start dosing the shit out of the servers

22 Reply by jxsl13

  • jxsl13
  • jxsl13
  • Member
  • Offline

Re: 0.6.4 released - another security fix

not possible.

Teeworlds [ friends ] clan
Some YouTube Stuff about Teeworlds

23 Reply by sytestorm

  • sytestorm
  • New member
  • Offline

Re: 0.6.4 released - another security fix

Ofcourse it's possible. You have to modify the client and change it so the IP adress is hidden instead of being revealed. release a new version.

24 Reply by Pathos

  • Pathos
  • Member
  • Offline

Re: 0.6.4 released - another security fix

sytestorm wrote:

Ofcourse it's possible. You have to modify the client and change it so the IP adress is hidden instead of being revealed. release a new version.

Modify the client and release a new version? This game is open source. They can undo the modifications for whatever you're thinking of while keeping all other changes.

Also, I don't think you understand how DDOS works. You don't need a Teeworlds client.

Hopefully, I'm not feeding a troll. Otherwise, I guess these posts can be removed.

Learn to move faster
Set up TW server on Pi  :: Vanilla/TW+ server configs :: Vanilla maps

25 Reply by dremy

  • dremy
  • dremy
  • Member
  • Offline

Re: 0.6.4 released - another security fix

yo, is anyone updating the game anymore? nostalgia hits me .

If you want a perfect map for your own server you can PM me to make you one ^^

Please also try play nodes you may download it here!. And as always.Have a nice day