Topic: Security Bug found with Bukkit/Vanilla - Server update required

darkfact
Contributor
Lil' metool

Inactive
1 post

Just saw this today - thought I'd post on the forum as it is a rather large security hole. Apparently an authentication bug has been discovered in Vanilla that potentially allows users to log in as any player (i.e. admin, etc.) They tracked the issue down and put out an update today (9/4) for Bukkit to address the issue.

http://www.reddit.com/r/admincraft/comments/1llt2h/craftbukkit_fix_for_authentication_exploit/

http://www.planetminecraft.com/blog/psa-server-exploit-discovered-update-immediately/

kagato
Contributor
Superstar!

Offline
316 posts

And just realized I posted this under the wrong user - registered a second account this morning as I own two Minecraft accounts

Chuck Norris doesn't need garbage collection because he doesn't call .Dispose(), he calls .DropKick().

Doctacosa
Admin
SciLab Official
Benevolent Dictator

Offline
6437 posts

... and 25 more

Thanks for the report!

There's no stable update from Bukkit available at this point, and since this exploit is one difficult to pull off, I'll hold off on updating. Jumping over to a mostly untested release is more likely to cause problems than a low-probability security hole.

I'll keep an eye out for further updates.

The admin formerly known as Dr. Cossack.

Looking for me elsewhere? Maybe look at my Fediverse account for some more-or-less random postings! If you're a gamer, check out my Osmium profile. I'm building that tool!

Doctacosa
Admin
SciLab Official
Benevolent Dictator

Offline
6437 posts

... and 25 more

The Bukkit update I was waiting for was released yesterday, and I installed it this morning. We're now protected!

The admin formerly known as Dr. Cossack.

Looking for me elsewhere? Maybe look at my Fediverse account for some more-or-less random postings! If you're a gamer, check out my Osmium profile. I'm building that tool!