Luigi Auriemma

Some (1,2 - tffa, 3 - duel, 4 - siege) my JKA servers was hacked, I can't understand, how. They steal the rcon, but not changed it. This passwords can't be bruted or stolen by trojan. How they hacked me? Mods: none, basejka.

configfiles:

http://rapidshare.com/files/235322714/cfg.rar.html

rconpasswords:
rconpassword "m10zmal*@0zkel10zekej20())xkkx----201"
rconpassword "@(*)!(0x9zz08xz9*)$#(*$#)$*)@!43MMM!kkskjdsk21" :)
sv_allowdownload, callvote bug - fixed.

How? lol

it could be retrieved through the so called "callvote bug" (quake3-engine-callvote-bug-t686.html), indeed you have the voting enabled on your server.

if you disable the voting you "should" be safe, otherwise if you have a windows server you can try my fix (http://aluigi.org/patches/q3cbufexecfix.lpatch).
in the previously linked thread someone linked also a "patch" for jka linux but being closed source it's NOT trusted so I don't suggest it (anyway it's all up to you)

Duel server:

hmm... and i fix it (callvote bug).

My servers was hacked by a "super-hackers"? xD'

Only 2 of my servers has vote enabled, but all was hacked. And, I repeat, password's wasn't changed - all this mean, that they aren't used callvote bug

uhmmm except for the previous post I don't think to have more info or hypothesis due to the following technical reasons:
- I have never played JKA
- I have never performed bugs researching specific for JKA (indeed jamsgbof is only an effect of another bug in the q3 engine)
- I don't know specific bugs of JKA
- I don't know specific bugs in mods used by JKA
- I know the details only of the bugs direcly found by me (listed in my Advisories section) but except for the info written in those advisories I don't know more about them (I'm aware of the callvote bug ONLY because it was showed me directly on my forum)
- about the so called callvote bug, I created only that windows patch but didn't look deeper in all the possible ways to exploit that vulnerability or possible ways specific of a particular game or particular exception (uhmmm for example if an old game doesn't filter even the ';' char)
- the callvote bug allows to execute any command on the server (modifying the rcon password is only the command I suggest to test the bug NOT the only possible command)
- something else I forgot as usual

so this is what I know personally, maybe someone else here can help you

Okay, there is a concept. If your 3 Server all are on the same root, and one of the server has vote enabled.
Enable Vote, change rcon, log in rcon, look with rcon path at the Hostname and path of the other server, start q3dirtrav, enter server.cfg, write in console, for example, download /home/newonje/Server1/base/server.cfg
and you ve got the server cfg from the server which has download 0.
that explains that they didnt have to change the rcon, because they have the server.cfg. logical^^