Security issue in Java based server
#11
(04-18-2015, 11:11 PM)Jammet Wrote: Sadly, I know nothing John Snow, er I mean, of how to work it. Hope you all on the team find it's not too much hassle.

References.
Reply
Thanks given by:
#12
Recursion depth alone won't prevent this attack - it has a maximum depth of 6, which is a perfectly reasonable NBT depth. And again, what maximum size to choose for the uncompressed packets?
Reply
Thanks given by:
#13
Well since we limit packet size to 32 KiB I suggest 512 KiB as a limit. Most non-pathological structured data has a less than 10:1 compression ratio so having a limit of 16 times compressed size seems reasonable. Limiting this in the NBT parser could be as simple as limiting the size of cFastNBT::m_Tags to a sensible value. Can I suggest 1,000?

Recursion depth for NBT was more of a general issue as if you can jump the guard page it allows the attacker to write arbitrary data to memory.
Reply
Thanks given by:




Users browsing this thread: 2 Guest(s)