medium5.0Public exploit code

CVE-2006-3325

client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwri…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow2006-07-02 · dos · windows_x86 · Verified
Quake 3 Engine Client - 'CG_ServerCommand()' Remote Overflow2006-07-02 · dos · windows · Verified

Impact

client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.

Affected products

Vendor	Product	Affected versions
Id Software	Quake 3 Engine	All versions Versions 1.32b, 1.32c, icculus_803, icculus_804, icculus_805

Public exploit code

Impact

Affected products

References