[Discussion] TeamSpeak 3 Client 3.2.5

[Chris]

This thread is for discussion and feedback for the 3.2.5 release of the TeamSpeak Client.
Please see the announcement for changelog / features.

[MeltDownPlayer]

I wonder why you even bothered to patch, if you try it you end up with

<20:33:04> Trying to resolve hostname voice.teamspeak.com -platformpluginpath \\192.168.131.152\share
<20:33:04> Failed to resolve hostname 'voice.teamspeak.com -platformpluginpath \\192.168.131.152\share'

anyways

[plizze]

The important question is, how is this exploitable?

By textchat to other users?? That would be a true desaster..

Regards

[alexg]

The important question is, how is this exploitable?

By textchat to other users?? That would be a true desaster..

Regards

We currently do not believe that there is way to exploit this using the textchat in the TeamSpeak Client.

[FireEmerald]

We currently do not believe that there is way to exploit this using the textchat in the TeamSpeak Client.

So you know that there's a security vulnerability but you don't know if it could be exploited in any way? Doesn't this mean that you don't know if your application is affected?

[hunterpl]

This thread is for discussion and feedback for the 3.2.5 release of the TeamSpeak Client.
Please see the announcement for changelog / features.

Chris, you will force minimal client join in version 3.8.0 server stable release?

[alexg]

So you know that there's a security vulnerability but you don't know if it could be exploited in any way? Doesn't this mean that you don't know if your application is affected?

We have verified and tested a way to exploit this, I was merely saying that we haven't yet found a way to exploit this using the built-in textchat.
After verifying that we are affected it was more important to use to get the fix out, rather than spent that time finding all the possible combinations this can be exploited.
I always try to avoid speaking in absolutes. I strongly believe that it is not possible to exploit this using the textchat,
but there are always things that you overlook in a large code base or things to try that you couldn't think of.

[cydolo]

If this is a security update, why not introduce something that prompts the client to update directly. Otherwise, the client can not be used. There are so many users who not see the announcements in the forum or even ignore the update.

[Screech]

If this is a security update, why not introduce something that prompts the client to update directly. Otherwise, the client can not be used. There are so many users who not see the announcements in the forum or even ignore the update.

The default client setup will notify them of the update. Also, them suggesting server admins increase the minimum client version make them update to connect to that server should give them a clue to update.