CVE-2006-3324

EPSS 4.4%

The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/1976unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://aluigi.altervista.org/adv/q3cfilevar-adv.txt http://secunia.com/advisories/20401 http://secunia.com/advisories/20851 http://securityreason.com/securityalert/1171 https://exchange.xforce.ibmcloud.com/vulnerabilities/27486 http://svn.icculus.org/quake3?rev=804&view=rev http://www.securityfocus.com/archive/1/438515/100/0/threaded http://www.securityfocus.com/archive/1/438660/100/0/threaded http://www.securityfocus.com/bid/18685 http://www.vupen.com/english/advisories/2006/2569