[3.0.11.3 + 3.0.10.2] Disconnecting and blocking clients until reboot of TS3SRV

Energeek

Your best friend
Aug 17, 2015
6
9
38
Hello,

Since 1-2 days, I've seen Minecraft TeamSpeak Servers crashing. The symptoms are :
<17:04:27> Disconnected from server (undefined error)
<17:04:45> Trying to resolve hostname ts.epicube.fr
<17:04:46> Trying to connect to server on ts.epicube.fr
<17:04:46> Maximum number of connections with the same identity exceeded.

And when we try to reconnect :
<17:06:15> Trying to resolve hostname ts.epicube.fr
<17:06:16> Trying to connect to server on ts.epicube.fr
<17:06:16> Bienvenue sur le TeamSpeak d'Epicube !

N'oublie pas de lire le règlement de notre serveur vocal : ICI !
<17:06:16> Bienvenue sur le TeamSpeak d'Epicube !

N'oublie pas de lire le règlement de notre serveur vocal : http://forum.epicube.fr/threads/reglement-du-serveur-vocal-ts3.72942/
<17:06:16> Disconnected from server (convert error)

So, I just bring you there is a fault like this. Do you know how to exploit it?
 
Last edited:

Supervisor

Administrator
Apr 27, 2015
1,863
2,546
335
<17:04:27> Disconnected from server (undefined error)
<17:04:45> Trying to resolve hostname ts.epicube.fr
<17:04:46> Trying to connect to server on ts.epicube.fr
<17:04:46> Maximum number of connections with the same identity exceeded.
The interesting part is the "undefined error" when loosing connection. The error when trying to reconnect only tells you that you did not time out on the server yet.

For the second one, only the last log is interesting:
<17:06:16> Disconnected from server (convert error)
I'm gonna look up the "convert error", but this seems worth digging into :D
Thanks for sharing
 

Supervisor

Administrator
Apr 27, 2015
1,863
2,546
335
Can you share your ts3 log? it's located in %appdata%\TS3Client. That should give more information about the error.
Do you use any special, non latin characters? Do you use any addons?

But I'm afraid this seems to be a client side problem, not server side.
How many users do experience that error on your server?
Just in case you really still use 3.0.10.3 -> This exploit should make you update!
You may also use this link to test the crash.
 

Derp

Retired Staff
Contributor
Apr 30, 2015
933
1,017
217
Interesting... As Supervisor said, this seems worth digging into.
 

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,028
896
216
The ts server (epicube) is up to date (3.0.11.3).
The convert error seems to be a bug with the client. Was more of a problem with the server.
The undefined error is very very interesting indeed.
 
Last edited:

Derp

Retired Staff
Contributor
Apr 30, 2015
933
1,017
217
Interesting stuff I found on Bluscream's log (TeamSpeak Forum)


2015-08-04 09:16:49.639875|ERROR |SCHandler |1 |Error from ChanClients: convert error
2015-08-04 09:16:49.639875|WARNING |SCHandler |1 |Error while parsing packet: convert error
2015-08-04 09:16:49.640875|WARNING |SCHandler |1 |Got command data while disconnected, dropping
2015-08-04 09:16:49.640875|WARNING |SCHandler |1 |Got command data while disconnected, dropping
2015-08-04 09:16:49.640875|WARNING |SCHandler |1 |Got command data while disconnected, dropping
2015-08-04 09:16:49.640875|WARNING |SCHandler |1 |Got command data while disconnected, dropping
2015-08-04 09:16:49.827001|ERROR |ClientUI |1 |Failed to get hostmessage mode

And, on reconnect (after convert error message)

2015-08-04 09:17:36.496212|ERROR |ClientUI |1 |Failed to get channel id from channel name
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.496212|INFO | | |Failed to get own channel ID when setting 3D sound for whiperer
2015-08-04 09:17:36.527233|INFO |ClientUI |1 |Connect status: Disconnected

idk... @Bluscream , you think 3D sound is somehow related to that?
 

Asphyxia.Cell

Member
Aug 13, 2015
25
28
45
A convert error would most probably be the client receiving a alphabetical character in place of an integer, without proper error handling for example. Perhaps forcing your ping to a letter for example or a decimal number like 5.5 and so on, when the client is looking to read an integer like 5 or 55.

With that being said there are many different things that could potentially cause this. Don't just pair together each convert error, as one may be different from another --- one may trigger a crash on all versions for example on accident although it may be controllable. Imagine on accident looking at logs and being able to crash people by modifying a value through tampering data. ;) if everything isn't checked, this is a possibility.
 

ehthe

Retired Staff
Contributor
Apr 26, 2015
1,028
896
216
Some errors I got from the binaries :)
Code:
invalid quote
invalid parameter count
invalid parameter
parameter not found
convert error
invalid parameter size
missing required parameter
invalid checksum
Connection lost
not connected
no cached connection info
currently not possible
The thing is I do not know if those are client or server related as they appear in both binaries.
 

Asphyxia.Cell

Member
Aug 13, 2015
25
28
45
Some errors I got from the binaries :)
Code:
invalid quote
invalid parameter count
invalid parameter
parameter not found
convert error
invalid parameter size
missing required parameter
invalid checksum
Connection lost
not connected
no cached connection info
currently not possible
The thing is I do not know if those are client or server related as they appear in both binaries.
I will jump on and look into this when I get on. It sure would be cool if we could find a database injection method through creating a channel for example. That would really be legendary.
 

Energeek

Your best friend
Aug 17, 2015
6
9
38
Here is the TS3 client logs for the 3.0.11.3 server :
2015-08-17 15:04:27.715834|WARNING |SCHandler |6 |Error from ChanClients: convert error
2015-08-17 15:04:27.715834|WARNING |SCHandler |6 |Error while parsing packet: undefined error
2015-08-17 15:04:27.721834|INFO |ClientUI |6 |Connect status: Disconnected
2015-08-17 15:04:27.726834|INFO |ClientUI |6 |Disconnected from server, no autoreconnect: undefined error
2015-08-17 15:04:27.740836|INFO |Bookmarks | |Disconnect, total time: 62532 - 166877
2015-08-17 15:04:45.660105|INFO |ClientUI |6 |Connect to server: ts.epicube.fr
2015-08-17 15:04:45.667105|INFO |ClientUI |6 |Trying to resolve ts.epicube.fr
2015-08-17 15:04:45.755116|INFO |TSDNS | |No SRV TSDNS found at "_tsdns._tcp.epicube.fr"
2015-08-17 15:04:45.763118|INFO |TSDNS | |SRV DNS resolve unsuccessful for "_ts3._udp.ts.epicube.fr"
2015-08-17 15:04:45.766118|INFO |TSDNS | |DNS resolve successful, "ts.epicube.fr"=151.80.21.81
2015-08-17 15:04:46.201174|INFO |ClientUI |6 |Lookup finished: 151.80.21.81 9987 ts.epicube.fr 0 0
2015-08-17 15:04:46.201174|INFO |ClientUI |6 |Resolve successful: 151.80.21.81:9987
2015-08-17 15:04:46.201174|INFO |ClientUI |6 |Blacklist check ok
2015-08-17 15:04:46.201174|INFO |ClientUI |6 |Initiating connection: 151.80.21.81:9987 ts.epicube.fr
2015-08-17 15:04:46.250180|INFO |ClientUI |6 |Connect status: Connecting
2015-08-17 15:04:46.413200|DEVELOP |PktHandler | |Puzzle solve time: 102
2015-08-17 15:04:46.531215|INFO |ClientUI |6 |Connect status: Disconnected
2015-08-17 15:04:46.531215|INFO |ClientUI |6 |Disconnected or forced to leave, want autoreconnect = 0
2015-08-17 15:06:15.557485|INFO |ClientUI |6 |Connect to server: ts.epicube.fr
2015-08-17 15:06:15.563486|INFO |ClientUI |6 |Trying to resolve ts.epicube.fr
2015-08-17 15:06:15.625494|INFO |TSDNS | |SRV DNS resolve unsuccessful for "_ts3._udp.ts.epicube.fr"
2015-08-17 15:06:15.641496|INFO |TSDNS | |DNS resolve successful, "ts.epicube.fr"=151.80.21.81
2015-08-17 15:06:16.079551|INFO |ClientUI |6 |Lookup finished: 151.80.21.81 9987 ts.epicube.fr 0 0
2015-08-17 15:06:16.079551|INFO |ClientUI |6 |Resolve successful: 151.80.21.81:9987
2015-08-17 15:06:16.079551|INFO |ClientUI |6 |Blacklist check ok
2015-08-17 15:06:16.079551|INFO |ClientUI |6 |Initiating connection: 151.80.21.81:9987 ts.epicube.fr
2015-08-17 15:06:16.141560|INFO |ClientUI |6 |Connect status: Connecting
2015-08-17 15:06:16.211569|DEVELOP |PktHandler | |Puzzle solve time: 10
2015-08-17 15:06:16.352586|INFO |ClientUI |6 |Connect status: Connected
2015-08-17 15:06:16.465600|INFO |ClientUI |6 |Connect status: Establishing connection
2015-08-17 15:06:16.546610|ERROR |SCHandler |6 |Error from ChanClients: convert error
2015-08-17 15:06:16.547610|WARNING |SCHandler |6 |Error while parsing packet: convert error
2015-08-17 15:06:16.549610|WARNING |SCHandler |6 |Got command data while disconnected, dropping
2015-08-17 15:06:16.549610|WARNING |SCHandler |6 |Got command data while disconnected, dropping
2015-08-17 15:06:16.549610|WARNING |SCHandler |6 |Got command data while disconnected, dropping
2015-08-17 15:06:16.549610|WARNING |SCHandler |6 |Got command data while disconnected, dropping
2015-08-17 15:06:16.549610|WARNING |SCHandler |6 |Got command data while disconnected, dropping
2015-08-17 15:06:16.569613|INFO |ClientUI |6 |Connect status: Disconnected
2015-08-17 15:06:16.574613|INFO |ClientUI |6 |Disconnected from server, no autoreconnect: convert error
2015-08-17 15:06:16.577614|INFO | | |Failed to download remote image: Error downloading http://epicube.fr/favicon.png - server replied: Not Found 203
(2h of difference between client chat and client logs, lol)

I've specified 3.0.10.2 because I've seen this problem on a server running this version (problem present in both versions). But this log come from a fault of a 3.0.11.3 TS3 server.
TeamSpeak servers where clients encountering this problem seems to need to restart. We can not connect before a reboot.
Client version: 3.0.17 (04/08/2015 09:38:33) [Stable] on Windows
 
Last edited:

kalle

high minded
Contributor
Oct 28, 2015
411
253
178
This problem i facing now.
<20:10:26> Disconnected from server (undefined error)
<20:14:26> Trying to resolve hostname ts3.europa.info.tm
<20:14:27> Trying to connect to server on ts3.europa.info.tm
<20:14:33> Failed to connect to server
 

bl4uni

Active Member
Sep 10, 2015
106
69
73
This thread is very old.
If you believe that the problem you're facing actually has something to do with this exploit you should update your server to the newest version. If it's not your server try to tell an admin.
 
Top