December 6th, 2003, 11:12 PM
Say i was running a public gamming server, just incase this helps its a Half-Life mod called Natural-Selection. Could a user send special or corrupt packets to change some settings on the servers configuration?
December 6th, 2003, 11:15 PM
I really never had a problem running a half life server. The latest vuln is the fact of overloading a server with bots so no users can join. (Its a form of DOS attack). So, I would have to say if you have the basic security settings assign to the box and you run the server under a (Restricted User Account) you have nothing but Lags and DOS's to worry about. If you have any specific questions feel free to PM me.
December 7th, 2003, 01:13 AM
There have historically been quite a lot of exploits in game servers. However, you don't usually need to run them as root, and with a little work, they can be run inside a chroot.
This means that someone who successfully exploits the game server cannot then easily take over the box at least.
As game servers are usually provided as binary-only, and are often not patched very quickly, it may be worthwhile using some kind of anti-buffer overflow tool, such as libsafe, which can work without needing the source. It won't necessarily stop every exploit, but it's likely to make a lot of "cookbook" exploits not work, and stop many altogether. And until the game vendor patches it, it's the best you can do.