Half-Life 2 source code stolen through IE exploit

[Thor Larholm]

http://www.halflife2.net/forums/showthread.php?s=e6e7d0ce0abe19997425ef50fa7fe1df&threadid=10692



Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/unpatched - 31 Unpatched IE Security Vulnerabilities

[Thor Larholm]

I can positively confirm that the source code has been leaked, including =
model and level editors and early work on the next version of =
counter-strike.


Thor

-----Original Message-----
From: Mattox, Norman [mailto:NMattox@scor.com]=20
Sent: Friday, October 03, 2003 9:34 AM
To: Thor Larholm; bugtraq@securityfocus.com
Subject: RE: Half-Life 2 source code stolen through IE exploit


Maybe not true.

Hard to tell from their web site.

-----Original Message-----
From: Thor Larholm [mailto:thor@pivx.com]
Sent: Friday, October 03, 2003 3:19 AM
To: bugtraq@securityfocus.com
Subject: Half-Life 2 source code stolen through IE exploit


http://www.halflife2.net/forums/showthread.php?s=3De6e7d0ce0abe19997425ef=
50fa7fe1df&threadid=3D10692



Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher =
http://pivx.com/larholm/unpatched - 31 Unpatched IE Security =
Vulnerabilities



************************************************** ********************
Ce message est exclusivement destin=E9 aux personnes dont
le nom figure ci-dessus. Il peut contenir des informations =
confidentielles dont la divulgation est =E0 ce titre=20
rigoureusement interdite. Dans l'hypoth=E8se o=F9 vous auriez=20
re=E7u ce message par erreur, merci de le renvoyer =E0 l'adresse e-mail =
ci-dessus.

This message is intended for the above-mentioned=20
addressees only. It may contain confidential information
the review, dissemination or disclosure of which is strictly prohibited. =
Should you receive this message in error, please return it to the e-mail =
address indicated above.
************************************************** ********************

[Thor Larholm]

There hasn't been an Outlook vulnerability for years, the only
vulnerabilities you can exploit these days in Outlook are the ones that
are caused by the fact that Outlook uses IE to render HTML mails.

Hence the speculation on my part ;)


Thor

-----Original Message-----
From: spackard@fastlink.com [mailto:spackard@fastlink.com]=20
Sent: Friday, October 03, 2003 11:12 AM
To: Thor Larholm
Cc: bugtraq@securityfocus.com
Subject: Re: Half-Life 2 source code stolen through IE exploit


Um, the way that site reads it was a buffer overflow
in Outlook. The thread's author just mentions IE as an aside.

Regards, Scott

On Fri, 3 Oct 2003, Thor Larholm wrote:

> Date: Fri, 3 Oct 2003 01:19:18 -0700
> From: Thor Larholm <thor@pivx.com>
> To: bugtraq@securityfocus.com
> Subject: Half-Life 2 source code stolen through IE exploit
>=20
> =
http://www.halflife2.net/forums/showthread.php?s=3De6e7d0ce0abe19997425e
> f50fa7fe1df&threadid=3D10692
>=20
>=20
>=20
> Regards
> Thor Larholm
> PivX Solutions, LLC - Senior Security Researcher=20
> http://pivx.com/larholm/unpatched - 31 Unpatched IE Security=20
> Vulnerabilities
>=20

--=20

[spackard@fastlink.com]

Um, the way that site reads it was a buffer overflow
in Outlook. The thread's author just mentions IE as an aside.

Regards, Scott

On Fri, 3 Oct 2003, Thor Larholm wrote:

> Date: Fri, 3 Oct 2003 01:19:18 -0700
> From: Thor Larholm <thor@pivx.com>
> To: bugtraq@securityfocus.com
> Subject: Half-Life 2 source code stolen through IE exploit
>
> http://www.halflife2.net/forums/showthread.php?s=e6e7d0ce0abe19997425ef50fa7fe1df&threadid=10692
>
>
>
> Regards
> Thor Larholm
> PivX Solutions, LLC - Senior Security Researcher
> http://pivx.com/larholm/unpatched - 31 Unpatched IE Security Vulnerabilities
>

--

[Mattox, Norman]

Maybe not true.

Hard to tell from their web site.

-----Original Message-----
From: Thor Larholm [mailto:thor@pivx.com]
Sent: Friday, October 03, 2003 3:19 AM
To: bugtraq@securityfocus.com
Subject: Half-Life 2 source code stolen through IE exploit


http://www.halflife2.net/forums/showthread.php?s=3De6e7d0ce0abe19997425ef50=
fa7fe1df&threadid=3D10692



Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/unpatched - 31 Unpatched IE Security Vulnerabilities



************************************************** ********************
Ce message est exclusivement destin=E9 aux personnes dont
le nom figure ci-dessus. Il peut contenir des informations
confidentielles dont la divulgation est =E0 ce titre=20
rigoureusement interdite. Dans l'hypoth=E8se o=F9 vous auriez=20
re=E7u ce message par erreur, merci de le renvoyer =E0 l'adresse
e-mail ci-dessus.

This message is intended for the above-mentioned=20
addressees only. It may contain confidential information
the review, dissemination or disclosure of which is strictly
prohibited. Should you receive this message in error,
please return it to the e-mail address indicated above.
************************************************** ********************

[jelmer]

Actually there have been a couple, just of of the top of my head there's

quartz.dll overflow

http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2003-07/0301.html

urlmon.dll overflow

http://lists.insecure.org/lists/bugtraq/2003/Jul/0019.html

and then 0day also doesn't exist right ?

I dont think there's cause for this kind of speculation.

--jelmer


----- Original Message -----
From: "Thor Larholm" <thor@pivx.com>
To: <spackard@fastlink.com>
Cc: <bugtraq@securityfocus.com>
Sent: Friday, October 03, 2003 9:10 PM
Subject: RE: Half-Life 2 source code stolen through IE exploit


There hasn't been an Outlook vulnerability for years, the only
vulnerabilities you can exploit these days in Outlook are the ones that
are caused by the fact that Outlook uses IE to render HTML mails.

Hence the speculation on my part ;)


Thor

-----Original Message-----
From: spackard@fastlink.com [mailto:spackard@fastlink.com]
Sent: Friday, October 03, 2003 11:12 AM
To: Thor Larholm
Cc: bugtraq@securityfocus.com
Subject: Re: Half-Life 2 source code stolen through IE exploit


Um, the way that site reads it was a buffer overflow
in Outlook. The thread's author just mentions IE as an aside.

Regards, Scott

On Fri, 3 Oct 2003, Thor Larholm wrote:

> Date: Fri, 3 Oct 2003 01:19:18 -0700
> From: Thor Larholm <thor@pivx.com>
> To: bugtraq@securityfocus.com
> Subject: Half-Life 2 source code stolen through IE exploit
>
> http://www.halflife2.net/forums/showthread.php?s=e6e7d0ce0abe19997425e
> f50fa7fe1df&threadid=10692
>
>
>
> Regards
> Thor Larholm
> PivX Solutions, LLC - Senior Security Researcher
> http://pivx.com/larholm/unpatched - 31 Unpatched IE Security
> Vulnerabilities
>

--