Quake Server Backdoor Vulnerability
BID:90
Info
Quake Server Backdoor Vulnerability
| Bugtraq ID: | 90 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Unknown |
| Published: | May 01 1998 12:00AM |
| Updated: | May 01 1998 12:00AM |
| Credit: | This vulnerability was found by Mark Zielinski <[email protected]> of Repent security Incorporated. |
| Vulnerable: |
id Software Solaris Quake II 3.14 id Software Solaris Quake II 3.13 id Software QuakeWorld 2.1 id Software QuakeWorld 2.0 id Software Quake II 3.14 id Software Quake II 3.13 id Software Quake 1.9 id Software Linux QuakeWorld 2.1 id Software Linux Quake II 3.14 a id Software Linux Quake II 3.13 |
| Not Vulnerable: |
id Software Linux QuakeWorld 2.2 id Software Linux Quake II 3.15 |
Discussion
Quake Server Backdoor Vulnerability
The Quake server has a feature where it allows administrators to remotely send commands to the Quake console with a password. However, it is possible to remotely bypass authentication.
In order for this to be exploited, the attacker would have to create a handcrafted udp packet with a header containing the rcon command and the password "tms" with a source IP coming from ID Software's Subnet. (192.246.40)
The Quake server does not require an open connection for sending the rcon packet. When this is exploited, no logs are reported of the rcon command being used.
This vulnerability is present in Quake 1, QuakeWorld, Quake 2, Quake 2 Linux and Quake 2 Solaris, all versions.
The Quake server has a feature where it allows administrators to remotely send commands to the Quake console with a password. However, it is possible to remotely bypass authentication.
In order for this to be exploited, the attacker would have to create a handcrafted udp packet with a header containing the rcon command and the password "tms" with a source IP coming from ID Software's Subnet. (192.246.40)
The Quake server does not require an open connection for sending the rcon packet. When this is exploited, no logs are reported of the rcon command being used.
This vulnerability is present in Quake 1, QuakeWorld, Quake 2, Quake 2 Linux and Quake 2 Solaris, all versions.
Solution / Fix
Quake Server Backdoor Vulnerability
Solution:
Filter all incoming packets from the subnet 192.246.40 or apply the rconfix created by David Wright from http://www.planetquake.com/arena/rconfix/.
This patch changes the backdoor password to be a'"' followed by two random characters. The Quake II string tokenizer cant parse '"' characters correctly. This may not be enough though. An atacker may use '\042' for a '"' and exhaustively search for the other two characters. A better soluition seem to be using '\000' in the password. This seems to confound Quake II's ability to check it.
This vulnerability will be fixed in the new releases of Quake II and QuakeWorld.
Solution:
Filter all incoming packets from the subnet 192.246.40 or apply the rconfix created by David Wright from http://www.planetquake.com/arena/rconfix/.
This patch changes the backdoor password to be a'"' followed by two random characters. The Quake II string tokenizer cant parse '"' characters correctly. This may not be enough though. An atacker may use '\042' for a '"' and exhaustively search for the other two characters. A better soluition seem to be using '\000' in the password. This seems to confound Quake II's ability to check it.
This vulnerability will be fixed in the new releases of Quake II and QuakeWorld.