Make a rule for this dos attack.

crime · 08-28-2006, 01:48 PM

Hi. There is a dos bug on Counter-strike servers. Im trying but dont have any idea how to make a rule.

http://milw0rm.com/exploits/1483

this is the source of exploit. Any ideas?

w3bd3vil · 08-28-2006, 02:09 PM

Quote:

PeerPort=>'27015',Proto=>'udp'

try blocking this port, if possible.

crime · 08-28-2006, 03:03 PM

Its the port of the Counter-Strike server. If block 27015, no one can connect.

crazyjimbo · 08-28-2006, 03:48 PM

I'm no expert at this (in fact, this is more of an educated guess) but looking at this line,

$q=$cmd."connect 47 $c2 \"\\prot\\4\\unique\\0\\raw\\valve\\cdkey\\f0ef8a36258af1bb64ed866538c9db76\"\"\\\"\0\0";

it looks like the data it sends always contains a pretty unique string. Could you look for that and block it?