[PSA] Please be careful when playing on Source games for a while

[Dr. Doctor (inactive)]

[ame]https://www.youtube.com/watch?v=bvrMHl80su8&feature=share[/ame]

To summarize: An exploit was discovered in TF2C that allowed a malicious script to be downloaded upon joining a server. The script would, among other things, steal your items and trigger VAC. The bug, of course, has spread to all games running on the 2013 version of Source engine. The only games patched (as far as we know) are Dota 2, Team Fortress 2, and Counter-Strike: Global Offensive.

As a temporary workaround, you can enter the following commands to stop the script downloading:

cl_allow download 0
cl_allowupload 0
cl_customsounds 0

Also completely disable sprays until the bug gets fixed. This may render some modded servers (like our CS:GO ones) unplayable, but as far as I know, ours don't download evil scripts.

Until we hear word from Valve, do be careful when joining custom servers in Source games.

 

[StealthGus]

CSS, DOD:S are/were also affected.

 

[Dr. Havok]

No bueno =(

 

[Q-tip]

so you have to be careful of custom servers, or ALL servers?

I dont play on any others than ours... am I safe?

 

[Zer0]

so you have to be careful of custom servers, or ALL servers?

I dont play on any others than ours... am I safe?

Mostly just custom map servers, I can't speak for the other divisions but DoD:S players usually have a few known servers that they frequent with known players on each. I'm sure if anything malicious was going on with them they would do as we would and get it corrected immediately on our end to protect the player base as well as we could until valve gets a fix pushed out. While I do believe you are safe, I would still be cautious and put the commands above in your autoexec for the time being.

 

[Q-tip]

done. thanks for the info

 

[whoflungpoo]

Has this been fixed? I wanted to download and go on a CSGO trade server, but didn't because i remembered this thread.

I know that there was a pdate for dods, css, and hl2:dm about a week ago, not sure if it was for this though.

 

[Dr. Havok]

I believe that update addressed this very issue.

 

[FireHazard772]

As far as I remember, it was only for DODS, CSS and DM (atleast thats what the headline was)