ID Software Quake II Server Multiple Remote Vulnerabilities

Bugtraq ID:	11551
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2004-2592 CVE-2004-2593 CVE-2004-2594 CVE-2004-2595 CVE-2004-2596 CVE-2004-2597 CVE-2004-2598
Remote:	Yes
Local:	No
Published:	Oct 27 2004 12:00AM
Updated:	Apr 13 2015 10:20PM
Credit:	Disclosure of these issues is credited to "Richard Stanway" <[email protected]>. bugmenot
Vulnerable:	id Software Quake II Server 3.21 id Software Quake II Server 3.20
Not Vulnerable:

ID Software Quake II Server Multiple Remote Vulnerabilities

Multiple remote vulnerabilities have been reported to affect Quake II. These issues are due to boundary condition checking failures, access validation failures and failures to handle exceptional conditions.

An attacker may leverage these issues to trigger a denial of service condition, execute arbitrary code, gain access to sensitive server files and rejoin a server that they have been banned from.

ID Software Quake II Server Multiple Remote Vulnerabilities

The following exploit is available:

cmd download maps/tca-zion.bsp -123456789

ID Software Quake II Server Multiple Remote Vulnerabilities

Solution:
Updates are available. Please see the references for details.

ID Software Quake II Server Multiple Remote Vulnerabilities

References:

• List of vulnerabilities in Quake II 3.20 (Server) by R1CH (Quakedev)
  
• R1Q2 - R1CHs Hacked Quake II Client/Server (R1CH.net)
  
• Topic: security (bugmenot)
  
• Multiple Vulnerabilites in Quake II Server ("Richard Stanway" )