this particular patch uses a shared "bucket" for both getstatus and getinfo limiting.
the following is an example sh(1) command line with which one can test the effects of this patch on a getinfo-DOSed server (that should be hosted at 127.0.0.1:27960):
while true ; do { printf '\377\377\377\377getinfo' | nc -u 127.0.0.1 27960 & } ; done
where nc(1) is the netcat utility.
When I looked at this for getstatus (CVE-2010-5077), the amplification factor for getinfo (in openarena, so based on an older ioquake3) was 4.4x, compared with 20x or more for getstatus:
> According to wireshark, using various commands on an unconfigured
> squeeze "listen server" (1 player in the game, playing on the server
> machine) has these amplification factors (I'm counting the size of the
> IP packet, so excluding Ethernet headers):
>
> command in/bytes out/bytes amp.
> --------------------------------------
> getstatus 41 802 20x (more on a config'd server?)
> getinfo 39 172 4.4x
> rcon 36 73 2x
> getchallenge 44 61 < 2x
> connect 39 71 < 2x (minimal connect message)
(<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665656>)
Is this actively being used in attacks?
Is there some other reason for critical severity?
(In reply to comment #3)
> Is this actively being used in attacks?
yes. there were reports and discussions about attacks on ioQuake3-based games. 5 months ago (around the time of the said events), i reported that the limiting functionality is missing from the getinfo code [1], but apparently noone listened.
> Is there some other reason for critical severity?
no. and perhaps the "criticalness" of this bug report is already out-of-date (by this time, server owners have applied some rate limiting of their own, etc.).
[1] http://lists.ioquake.org/pipermail/ioquake3-ioquake.org/2012-January/004785.html
(In reply to comment #5)
> fixed r2289
Do you consider this to be a sufficiently serious vulnerability that distributions should make it a security update? (If so, we should get a CVE number for it and do an advisory.)
It would be really good to have an ioquake3 1.37 release - there have been several security vulnerabilities fixed since 1.36.
(In reply to comment #4)
> (In reply to comment #3)
> > Is this actively being used in attacks?
>
> yes. there were reports and discussions about attacks on ioQuake3-based games.
> 5 months ago (around the time of the said events)
If I remember correctly, those reports were that getstatus (>= 20x traffic multiplication) was being used actively as an attack.
Are you aware of any uses of getinfo (< 5x multiplication) as an attack?
Created attachment 3233 [details] prevent using getinfo as an amplifier for DDOS attacksthis particular patch uses a shared "bucket" for both getstatus and getinfo limiting. the following is an example sh(1) command line with which one can test the effects of this patch on a getinfo-DOSed server (that should be hosted at 127.0.0.1:27960): while true ; do { printf '\377\377\377\377getinfo' | nc -u 127.0.0.1 27960 & } ; done where nc(1) is the netcat utility.