Description
server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openarena | 0.8.5-6 | — |
| Debian 13 | openarena | 0.8.5-6 | — |
| Debian 12 | openarena | 0.8.5-6 | — |
| Debian 6.0 | openarena | 0.8.5-5+squeeze2 | DSA-2442-1 |
Advisories 1
- DSA-2442-1 openarena - UDP traffic amplification Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20120326 Traffic amplification via Quake 3-based servers mailing-list
- http://openarena.ws/board/index.php?topic=4391.0
- DSA-2442 vendor-advisory
- http://www.urbanterror.info/forums/topic/27825-drdos/
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665656
- http://permalink.gmane.org/gmane.comp.games.ioquake3/961
- [oss-security] 20120326 Re: CVE-2010 Request: quake3 / openarena-server: DDoS by processing 'getstatus' and 'rcon' packets mailing-list
- http://www.ioquake.org/forums/viewtopic.php?f=12&t=1694