id Software Quake II Server Remote Information Disclosure Vulnerability
BID:4744
Info
id Software Quake II Server Remote Information Disclosure Vulnerability
| Bugtraq ID: | 4744 |
| Class: | Design Error |
| CVE: |
CVE-2002-0770 |
| Remote: | Yes |
| Local: | No |
| Published: | May 15 2002 12:00AM |
| Updated: | Jul 11 2009 12:46PM |
| Credit: | Published by Redix. |
| Vulnerable: |
id Software Quake II Server 3.21 id Software Quake II Server 3.20 |
| Not Vulnerable: | |
Discussion
id Software Quake II Server Remote Information Disclosure Vulnerability
Quake II is a multiplayer game released by id Software. The source code has been made publically available, and versions are available for Windows and Linux. A vulnerability has been reported in some versions of the Quake II server.
While variable expansion is normally performed on the client side, a modified client may pass unexpanded variables such as $rcon_password to the server. The server will expand these variables within it's local context, potentially leaking sensitive information to the remote attacker.
Quake II is a multiplayer game released by id Software. The source code has been made publically available, and versions are available for Windows and Linux. A vulnerability has been reported in some versions of the Quake II server.
While variable expansion is normally performed on the client side, a modified client may pass unexpanded variables such as $rcon_password to the server. The server will expand these variables within it's local context, potentially leaking sensitive information to the remote attacker.
Exploit / POC
id Software Quake II Server Remote Information Disclosure Vulnerability
Redix has contributed exploit details:
you must modify your q2 client, that the client will not replace the $... variables in says
quick hack:
in qcommon/cmd.c
change the line
Cmd_TokenizeString (text, true);
to
Cmd_TokenizeString( text, false);
Redix has contributed exploit details:
you must modify your q2 client, that the client will not replace the $... variables in says
quick hack:
in qcommon/cmd.c
change the line
Cmd_TokenizeString (text, true);
to
Cmd_TokenizeString( text, false);
Solution / Fix
id Software Quake II Server Remote Information Disclosure Vulnerability
Solution:
An unofficial patch has been contributed by Redix:
change line 481 in sv_user.c to
Cmd_TokenizeString (s, false);
Unofficial updates are also available.
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
id Software Quake II Server 3.20
id Software Quake II Server 3.21
Solution:
An unofficial patch has been contributed by Redix:
change line 481 in sv_user.c to
Cmd_TokenizeString (s, false);
Unofficial updates are also available.
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
id Software Quake II Server 3.20
-
BarrysWorld quake2-3.21-unofficial_server-linux.tar.gz
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/linux/qu ake2-3.21-unofficial_server-linux.tar.gz -
BarrysWorld quake2-3.21-unofficial_server-source.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/quake2-3 .21-unofficial_server-source.zip -
BarrysWorld quake2-3.21-unofficial_server-win32.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/win32/qu ake2-3.21-unofficial_server-win32.zip
id Software Quake II Server 3.21
-
BarrysWorld quake2-3.21-unofficial_server-linux.tar.gz
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/linux/qu ake2-3.21-unofficial_server-linux.tar.gz -
BarrysWorld quake2-3.21-unofficial_server-source.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/quake2-3 .21-unofficial_server-source.zip -
BarrysWorld quake2-3.21-unofficial_server-win32.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/win32/qu ake2-3.21-unofficial_server-win32.zip
References
id Software Quake II Server Remote Information Disclosure Vulnerability
References:
References:
- RCON_PASSWORD Security Issue (Quakesource.org)