CVE-2006-3324
published 2006-06-30CVE-2006-3324: The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite…
PriorityP431medium5CVSS 2.0
AVNACLAuNCNIPAN
EXPLOIT
EPSS
4.36%
90.0th percentile
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ioquake3 | < ioquake3 1.36+svn1788j-1 (bookworm) | ioquake3 1.36+svn1788j-1 (bookworm) |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2006-3324: ioquake3 - The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake...
vendor_debian·2006·CVSS 5.0
CVE-2006-3324 [MEDIUM] CVE-2006-3324: ioquake3 - The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake...
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
Scope: local
bookworm: resolved (fixed in 1.36+svn1788j-1)
bullseye: resolved (fixed in 1.36+svn1788j-1)
forky: resolved (fixed in 1.36+svn1788j-1)
sid: resolved (fixed in 1.36+svn1788j-1)
trixie: resolved (fixed in 1.36+svn1788j-1)
GHSA
GHSA-86g9-3p64-q3xg: The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to ov
ghsa_unreviewed·2022-05-01
CVE-2006-3324 [MEDIUM] GHSA-86g9-3p64-q3xg: The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to ov
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
OSV
CVE-2006-3324: The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to ov
osv·2006-06-30·CVSS 5.0
CVE-2006-3324 [MEDIUM] CVE-2006-3324: The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to ov
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
No detection rules found.
Bugzilla
multiple flaws in current version of tremulous
bugzilla·2012-02-22·CVSS 7.5
CVE-2006-2236 [HIGH] multiple flaws in current version of tremulous
multiple flaws in current version of tremulous
According to these Debian bug reports, tremulous suffers from a number of unresolved flaws:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660827: CVE-2006-2236 ("the remapShader exploit") can lead to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660830: CVE-2006-2875 ("q3cbof") stack-based buffer overflow leading to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660831: CVE-2006-2082 arbitrary file download from server
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660832: CVE-2006-3324 ("q3cfilevar-A") arbitrary file overwriting
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660834: CVE-2006-3325 ("q3cfilevar-B") configuration overwriting
In addition, tremulous suffers from
Bugzilla
tremulous: Multiple unfixed Quake3 engine security issues
bugzilla·2008-07-15·CVSS 7.5
CVE-2006-2236 [HIGH] tremulous: Multiple unfixed Quake3 engine security issues
tremulous: Multiple unfixed Quake3 engine security issues
Based on search started from http://bugs.gentoo.org/show_bug.cgi?id=222119 , it
seems that tremulous packages as shipped in Fedora contains multiple unfixed
security issues, that were previously addressed in Quake3:
CVE-2006-2236:
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to
Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers
to execute arbitrary commands via a long remapShader command.
Quake3 fix:
http://svn.icculus.org/quake3?view=rev&revision=765
Tremulous fix:
http://svn.icculus.org/tremulous?view=rev&revision=778
References:
http://www.securityfocus.com/archive/1/archive/1/433349/100/0/threaded
http://www.milw0rm.com/exploits/1750
http://secunia.com/advisories/199
http://aluigi.altervista.org/adv/q3cfilevar-adv.txthttp://secunia.com/advisories/20401http://secunia.com/advisories/20851http://securityreason.com/securityalert/1171http://svn.icculus.org/quake3?rev=804&view=revhttp://www.securityfocus.com/archive/1/438515/100/0/threadedhttp://www.securityfocus.com/archive/1/438660/100/0/threadedhttp://www.securityfocus.com/bid/18685http://www.vupen.com/english/advisories/2006/2569https://exchange.xforce.ibmcloud.com/vulnerabilities/27486http://aluigi.altervista.org/adv/q3cfilevar-adv.txthttp://secunia.com/advisories/20401http://secunia.com/advisories/20851http://securityreason.com/securityalert/1171http://svn.icculus.org/quake3?rev=804&view=revhttp://www.securityfocus.com/archive/1/438515/100/0/threadedhttp://www.securityfocus.com/archive/1/438660/100/0/threadedhttp://www.securityfocus.com/bid/18685http://www.vupen.com/english/advisories/2006/2569https://exchange.xforce.ibmcloud.com/vulnerabilities/27486
2006-06-30
Published