CVE-2006-2236
published 2006-05-08CVE-2006-2236: Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to…
PriorityP347high7.6CVSS 2.0
AVNACHAuNCCICAC
EXPLOIT
EPSS
7.59%
93.8th percentile
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ioquake3 | < ioquake3 1.36+svn1788j-1 (bookworm) | ioquake3 1.36+svn1788j-1 (bookworm) |
| id_software | quake_3_arena | — | — |
| id_software | quake_3_engine | — | — |
| id_software | return_to_castle_wolfenstein | — | — |
| id_software | wolfenstein_enemy_territory | — | — |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
CVSS provenance
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
osv7.6HIGH
vendor_debian7.6HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rx4g-vhm6-f7vc: Buffer overflow in the Quake 3 Engine, as used by (1) ET 2
ghsa_unreviewed·2022-05-01
CVE-2006-2236 [HIGH] GHSA-rx4g-vhm6-f7vc: Buffer overflow in the Quake 3 Engine, as used by (1) ET 2
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.
OSV
CVE-2006-2236: Buffer overflow in the Quake 3 Engine, as used by (1) ET 2
osv·2006-05-08·CVSS 7.6
CVE-2006-2236 [HIGH] CVE-2006-2236: Buffer overflow in the Quake 3 Engine, as used by (1) ET 2
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.
Debian
CVE-2006-2236: ioquake3 - Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Cas...
vendor_debian·2006·CVSS 7.6
CVE-2006-2236 [HIGH] CVE-2006-2236: ioquake3 - Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Cas...
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers to execute arbitrary commands via a long remapShader command.
Scope: local
bookworm: resolved (fixed in 1.36+svn1788j-1)
bullseye: resolved (fixed in 1.36+svn1788j-1)
forky: resolved (fixed in 1.36+svn1788j-1)
sid: resolved (fixed in 1.36+svn1788j-1)
trixie: resolved (fixed in 1.36+svn1788j-1)
No detection rules found.
Bugzilla
multiple flaws in current version of tremulous
bugzilla·2012-02-22·CVSS 7.5
CVE-2006-2236 [HIGH] multiple flaws in current version of tremulous
multiple flaws in current version of tremulous
According to these Debian bug reports, tremulous suffers from a number of unresolved flaws:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660827: CVE-2006-2236 ("the remapShader exploit") can lead to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660830: CVE-2006-2875 ("q3cbof") stack-based buffer overflow leading to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660831: CVE-2006-2082 arbitrary file download from server
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660832: CVE-2006-3324 ("q3cfilevar-A") arbitrary file overwriting
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660834: CVE-2006-3325 ("q3cfilevar-B") configuration overwriting
In addition, tremulous suffers from
Bugzilla
tremulous: Multiple unfixed Quake3 engine security issues
bugzilla·2008-07-15·CVSS 7.5
CVE-2006-2236 [HIGH] tremulous: Multiple unfixed Quake3 engine security issues
tremulous: Multiple unfixed Quake3 engine security issues
Based on search started from http://bugs.gentoo.org/show_bug.cgi?id=222119 , it
seems that tremulous packages as shipped in Fedora contains multiple unfixed
security issues, that were previously addressed in Quake3:
CVE-2006-2236:
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to
Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers
to execute arbitrary commands via a long remapShader command.
Quake3 fix:
http://svn.icculus.org/quake3?view=rev&revision=765
Tremulous fix:
http://svn.icculus.org/tremulous?view=rev&revision=778
References:
http://www.securityfocus.com/archive/1/archive/1/433349/100/0/threaded
http://www.milw0rm.com/exploits/1750
http://secunia.com/advisories/199
http://secunia.com/advisories/19984http://secunia.com/advisories/20065http://www.gentoo.org/security/en/glsa/glsa-200605-12.xmlhttp://www.osvdb.org/25279http://www.securityfocus.com/archive/1/433349/100/0/threadedhttp://www.securityfocus.com/bid/17857http://www.vupen.com/english/advisories/2006/1676https://exchange.xforce.ibmcloud.com/vulnerabilities/26264https://www.exploit-db.com/exploits/1750http://secunia.com/advisories/19984http://secunia.com/advisories/20065http://www.gentoo.org/security/en/glsa/glsa-200605-12.xmlhttp://www.osvdb.org/25279http://www.securityfocus.com/archive/1/433349/100/0/threadedhttp://www.securityfocus.com/bid/17857http://www.vupen.com/english/advisories/2006/1676https://exchange.xforce.ibmcloud.com/vulnerabilities/26264https://www.exploit-db.com/exploits/1750
2006-05-08
Published