ioQuake3 Engine Insecure Temporary File Creation Vulnerability
BID:54025
Info
ioQuake3 Engine Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 54025 |
| Class: | Design Error |
| CVE: |
CVE-2012-3345 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 14 2012 12:00AM |
| Updated: | Mar 19 2015 09:24AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
ioQuake3 Engine Insecure Temporary File Creation Vulnerability
The ioQuake3 Engine is prone to a vulnerability because it creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service or the attacker gaining elevated privileges on the affected computer.
The ioQuake3 Engine is prone to a vulnerability because it creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service or the attacker gaining elevated privileges on the affected computer.
Exploit / POC
ioQuake3 Engine Insecure Temporary File Creation Vulnerability
An attacker can use readily available commands to exploit this issue.
An attacker can use readily available commands to exploit this issue.
Solution / Fix
ioQuake3 Engine Insecure Temporary File Creation Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
ioQuake3 Engine Insecure Temporary File Creation Vulnerability
References:
References:
- Vendor Homepage (ioquake3)