CVE-2006-3325
published 2006-06-30CVE-2006-3325: client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to…
PriorityP430medium5CVSS 2.0
AVNACLAuNCNIPAN
EXPLOIT
EPSS
4.67%
90.6th percentile
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ioquake3 | < ioquake3 1.36+svn1788j-1 (bookworm) | ioquake3 1.36+svn1788j-1 (bookworm) |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| id_software | quake_3_engine | — | — |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2006-3325: ioquake3 - client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine...
vendor_debian·2006·CVSS 5.0
CVE-2006-3325 [MEDIUM] CVE-2006-3325: ioquake3 - client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine...
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
Scope: local
bookworm: resolved (fixed in 1.36+svn1788j-1)
bullseye: resolved (fixed in 1.36+svn1788j-1)
forky: resolved (fixed in 1.36+svn1788j-1)
sid: resolved (fixed in 1.36+svn1788j-1)
trixie: resolved (fixed in 1.36+svn1788j-1)
GHSA
GHSA-w943-j99v-c4q3: client/cl_parse
ghsa_unreviewed·2022-05-01
CVE-2006-3325 [MEDIUM] GHSA-w943-j99v-c4q3: client/cl_parse
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
OSV
CVE-2006-3325: client/cl_parse
osv·2006-06-30·CVSS 5.0
CVE-2006-3325 [MEDIUM] CVE-2006-3325: client/cl_parse
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
No detection rules found.
Exploit-DB
Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow
exploitdb·2006-07-02
CVE-2006-3401 Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow
Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow
---
/*
Quake 3 Engine Client CS_ITEMS Remote Stack Overflow Exploit (Win32)
Written by RunningBon
E-Mail: [email protected]
IRC: irc.rizon.net #kik
This is a DLL, which gets injected into the server exe.
You will need Microsoft Detours library to compile this exploit (http://research.microsoft.com/sn/detours/)
I recommend you compile this with Microsoft Visual C++
Use this responsibly. You are responsible for any damage you cause using this.
Info:
The engine strips bytes >127, '%', and '\0' before it overflows, so you will need encoded shellcode and an EIP which doesn't contain any of these characters.
*/
#include
#include
#include
struct VersionStruct {
char *pVersionString;
DWORD dwVersionStringAddr;
DWORD dwSetCo
Exploit-DB
Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow
exploitdb·2006-07-02
CVE-2006-3400 Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow
Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow
---
/*
Quake 3 Engine Client CG_ServerCommand() Remote Stack Overflow Exploit (Win32)
Written by RunningBon
E-Mail: [email protected]
IRC: irc.rizon.net #kik
This is a DLL, which gets injected into the server exe.
You will need Microsoft Detours library to compile this exploit (http://research.microsoft.com/sn/detours/)
Use this responsibly. You are responsible for any damage you cause using this.
Info:
The string is heavily filtered before the overflow occurs, so a lot of bytes get stripped. Might want to try alphanum shellcode..
*/
#include
#include
#include
struct VersionStruct {
char *pVersionString;
DWORD dwVersionStringAddr;
DWORD dwSendServerCommandAddr;
DWORD dwFillSize;
DWORD dwNewEIP;
};
VersionStruct Versi
Bugzilla
multiple flaws in current version of tremulous
bugzilla·2012-02-22·CVSS 7.5
CVE-2006-2236 [HIGH] multiple flaws in current version of tremulous
multiple flaws in current version of tremulous
According to these Debian bug reports, tremulous suffers from a number of unresolved flaws:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660827: CVE-2006-2236 ("the remapShader exploit") can lead to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660830: CVE-2006-2875 ("q3cbof") stack-based buffer overflow leading to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660831: CVE-2006-2082 arbitrary file download from server
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660832: CVE-2006-3324 ("q3cfilevar-A") arbitrary file overwriting
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660834: CVE-2006-3325 ("q3cfilevar-B") configuration overwriting
In addition, tremulous suffers from
Bugzilla
tremulous: Multiple unfixed Quake3 engine security issues
bugzilla·2008-07-15·CVSS 7.5
CVE-2006-2236 [HIGH] tremulous: Multiple unfixed Quake3 engine security issues
tremulous: Multiple unfixed Quake3 engine security issues
Based on search started from http://bugs.gentoo.org/show_bug.cgi?id=222119 , it
seems that tremulous packages as shipped in Fedora contains multiple unfixed
security issues, that were previously addressed in Quake3:
CVE-2006-2236:
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to
Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers
to execute arbitrary commands via a long remapShader command.
Quake3 fix:
http://svn.icculus.org/quake3?view=rev&revision=765
Tremulous fix:
http://svn.icculus.org/tremulous?view=rev&revision=778
References:
http://www.securityfocus.com/archive/1/archive/1/433349/100/0/threaded
http://www.milw0rm.com/exploits/1750
http://secunia.com/advisories/199
http://aluigi.altervista.org/adv/q3cfilevar-adv.txthttp://secunia.com/advisories/20401http://secunia.com/advisories/20851http://securityreason.com/securityalert/1171http://www.securityfocus.com/archive/1/438515/100/0/threadedhttp://www.securityfocus.com/archive/1/438660/100/0/threadedhttp://www.securityfocus.com/bid/18685http://www.vupen.com/english/advisories/2006/2569https://exchange.xforce.ibmcloud.com/vulnerabilities/26889https://exchange.xforce.ibmcloud.com/vulnerabilities/27486http://aluigi.altervista.org/adv/q3cfilevar-adv.txthttp://secunia.com/advisories/20401http://secunia.com/advisories/20851http://securityreason.com/securityalert/1171http://www.securityfocus.com/archive/1/438515/100/0/threadedhttp://www.securityfocus.com/archive/1/438660/100/0/threadedhttp://www.securityfocus.com/bid/18685http://www.vupen.com/english/advisories/2006/2569https://exchange.xforce.ibmcloud.com/vulnerabilities/26889https://exchange.xforce.ibmcloud.com/vulnerabilities/27486
2006-06-30
Published