A malicious Half-Life server can remotely cause arbitrary code to be executed by the Half-Life client. The code will be executed with the permissions of the Half-Life user.A vulnerability was reported in the Half-Life gaming system client, where a Half-Life server can trigger a buffer overflow in the client and execute arbitrary code on the client.

It is reported that there is a buffer overflow in the console command "connect" on Windows-based Half-Life clients. If the command is executed with approximately 128 characters, the buffer overflow can be triggered. A remote Half-Life server can apparently use the "g_engfuncs.pfnClientCommand" function to force the client to execute the console command. No solution was available at the time of this entry. A fix will reportedly be included in the next product update. "Stanley G. Bubrouski" <stan@ccs.neu.edu>