Description
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ioquake3 | 1.36+svn1788j-1 | — |
| Debian 13 | ioquake3 | 1.36+svn1788j-1 | — |
| Debian 12 | ioquake3 | 1.36+svn1788j-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow EDB-1976 · dos · Jul 2, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://svn.icculus.org/quake3?rev=804&view=rev
- 20060628 Re: Files and cvars overwriting in Quake 3 engine (1.32c / rev 803 / ...) mailing-list
- 20060627 Files and cvars overwriting in Quake 3 engine (1.32c / rev 803 / ...) mailing-list
- http://aluigi.altervista.org/adv/q3cfilevar-adv.txt
- 18685 vdb-entry
- 20851 third-party-advisory
- 1171 third-party-advisory
- 20401 third-party-advisory
- quake3-cvar-file-overwrite(27486) vdb-entry
- ADV-2006-2569 vdb-entry