Description
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ioquake3 | 1.36+svn1788j-1 | — |
| Debian 13 | ioquake3 | 1.36+svn1788j-1 | — |
| Debian 12 | ioquake3 | 1.36+svn1788j-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow EDB-1976 · dos · Jul 2, 2006 · verified
- Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow EDB-1977 · dos · Jul 2, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060628 Re: Files and cvars overwriting in Quake 3 engine (1.32c / rev 803 / ...) mailing-list
- 20060627 Files and cvars overwriting in Quake 3 engine (1.32c / rev 803 / ...) mailing-list
- http://aluigi.altervista.org/adv/q3cfilevar-adv.txt
- 18685 vdb-entry
- 20851 third-party-advisory
- 1171 third-party-advisory
- 20401 third-party-advisory
- quake3-cvar-file-overwrite(27486) vdb-entry
- ADV-2006-2569 vdb-entry
- quake3-clparsedownload-bo(26889) vdb-entry