Quake 3 Engine Client Multiple Stack Buffer Overflow Vulnerabilities

Bugtraq ID:	18777
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 03 2006 12:00AM
Updated:	Jul 07 2006 02:34PM
Credit:	RunningBon is credited with the discovery of these vulnerabilities.
Vulnerable:	Raven Software Soldier Of Fortune 2 1.0 3 id Software Quake 3 Engine (Icculus) 812 id Software Quake 3 Engine 1.32 c id Software Quake 3 Engine 1.32 b
Not Vulnerable:	id Software Quake 3 Engine (Icculus) 813

Quake 3 Engine Client Multiple Stack Buffer Overflow Vulnerabilities

The Quake 3 Engine client application is susceptible to multiple remote stack buffer-overflow vulnerabilities.

These issues allow remote attackers to execute arbitrary machine code with the privileges of the user running the client application.

Quake 3 Engine Client Multiple Stack Buffer Overflow Vulnerabilities

Attackers may exploit these issues via a C compiler and the Microsoft Detours library.

Sample exploit code has been provided:

• /data/vulnerabilities/exploits/quake-cs_items-stackoverflow.txt
• /data/vulnerabilities/exploits/quake-cg_servercommand-stackoverflow.txt

Quake 3 Engine Client Multiple Stack Buffer Overflow Vulnerabilities

Solution:
The vendor has released software updates to address this issue. Please see the references for details.

Quake 3 Engine Client Multiple Stack Buffer Overflow Vulnerabilities

References:

• icculus.org/quake3 Home Page (icculus.org)
  
• Luigi Auriemma Homepage (Luigi Auriemma)