🚀 go-pugleaf

swag:
http://secur1ty.net/advisories/001-Multiple_Vulnerabilites_In_Quake_II_Server.txt


Multiple Vulnerabilites in Quake II Server
==========================================
Product: Quake II
Version: Tested on 3.2x, likely all
 Vendor: iD Software (http://www.idsoftware.com/)
   Date: 2004-10-27
   Risk: High (possible remote code execution)
    URL: http://secur1ty.net/advisories/001

Background
==========
Quake  II is  a multiplayer  game featuring  around 750  active
servers
online.  Quake  II   was  open  sourced   in  December  2001
and  many
modifications have since been made.

As the Quake  II engine is  available for commercial  licensing,
some of
these  issues may  affect other  games based  on the  Quake II
engine,
including (but not limited to):

 * Anachronox
 * Daikatana
 * Heretic II
 * Kingpin: Life of Crime
 * Soldier of Fortune
 * Sin

Source: http://en.wikipedia.org/wiki/Quake_II

Issues
======
Due to unchecked input at various stages in the server, remote
users are
able to  cause  the  server to   crash, reveal sensitive
information or
potentially execute arbitrary code.

Problem #1 - Array bounds error
===============================
During  the  processing of  Configstrings  and Baselines used
during the
connection process,  the  Quake II client is expected to send the
offset
of the  array it  wants to   receive. However,  no checking  is
done  to
ensure  that  this  offset  is  not  negative,  resulting  in  an
access
violation  when the server attempts to  read this memory.

Problem #2 - Buffer overflow when parsing packets
=================================================
Upon receiving  a command  packet, the  server will  attempt to
split it
into chunks such as cmd_args  (everything after the function
name),  and
generating an  array  called  cmd_argv  so   that functions  can
easily
access parameters of the command.  The buffer designed to hold
cmd_args
is  only 1024 bytes while the maximum packet size is in the 1400+
bytes
range. No  checks are  made to  verify the  string length  before
it  is
copied into the cmd_args  buffer,   resulting in   a  buffer
overflow.

Depending  on the system architecture exploitation may be
possible,  but
is limited by  the fact that cmd_args resides in the data section
of the
executable. A typical overflow  will corrupt the cmd_functions
pointer,
causing execution of further commands  to crash the server. This
attack
can be performed without  having to connect to  the Quake II
server  and
requires only  a single  UDP packet  which may  allow for source
address
spoofing.

Problem #3 - Win32 server auto downloading allows leak
             of sensitive files
======================================================
Quake II allows users to download content from the server that
they need
to play, such as custom maps. However the server does not perform
enough
verification on the path supplied by the client for downloading.
Due  to
the  nature of  Win32 paths,  it is  possible to  specify for
example,
"download \/server.cfg"  as a  command which  will result  in the
server
sending  the file  server.cfg from  the mod  directory which
would not
normally be allowed.

Problem #4 - Linux server auto downloading DoS
==============================================
Linux  behaves  differently  to  Win32 when  a  file  open
operation is
attempted on a directory. Due  to insufficient checking of the
path, it
is  possible to  send a  command such  as "download  /maps/"
which  will
result  in  the  server  opening  the  maps  directory  and
subsequently
shutting down when it cannot read data from it.

Problem #5 - Fake clients DoS
=============================
Due to high timeout values and no limit of connections from a
single IP,
it  is  possible to  cause  the Quake  II  server to  refuse
legitimate
connections by filling it with "fake" clients. Only 2 UDP packets
need
to be sent  to initiate a  connection, which will  then occupy a
player
slot and take up to 2 minutes by default to time out. As no
limiting per
IP is done, a single 56k modem user could easily occupy 40+
client slots
using this method.

Reference: http://aluigi.altervista.org/fakep.htm

Problem #6 - IP Spoofing
========================
The  Quake II  client constructs  a string  known as  the
userinfo  that
contains  key/value pairs   of important  settings, such  as the
player
name,  skin, etc.   When the   server  reads  the client's
userinfo  it
inserts a new key/value pair called "ip"  with the client's IP
address
to allow mods to see the client IP when they look at the
userinfo.

It is possible  to construct a  client userinfo string large
enough  so
that   a key/value  pair will  be truncated.   By then  inserting
a  key
called "ip", it  is possible  to  trick  a mod  into reading  the
wrong
IP from   the userinfo. Since it  is the responsibility  of mods
to  ban
users from   the server,  a malicious  user can  evade any  bans
on  the
server.

Problem #7 - Damage of client state structure
=============================================
By  not  properly issuing  a  disconnect command,  a  client can
remain
connected  to a  server even  after supposedly  disconnecting.
When  the
client  reconnects,  the  server  will  try  to  find  a  slot
that was
previously allocated to  that client and  re-use  it.  However
no check
is done to  ensure that this slot is truly no longer in use,
resulting
in overwriting  of  any  old client  state  without  notifying
the   mod
which can  result in client  cleanup code not  running and
inconsistent
player counts amongst other mod-specific issues.

Problem #8 - Local buffer overflows
===================================
A number of functions designed to be executed from the server
console or
rcon do not properly check  buffer sizes, resulting in a  crash.
However
since these can only be exploited from someone with direct access
to the
server, they are a low threat.

I would also like to remind  server admins that the original
version  of
the Quake II server (still in use by approximately 260 servers
according
to the All-Seeing Eye) has even  larger risks as it is trivial
to steal
the rcon  password and  perform actions  as if  you were  at the
server
console, including browsing of the host system directory
structure.

Reference: http://seclists.org/lists/bugtraq/2002/May/0127.html

Vendor Response
===============
As the product is  now open source, it  is not expected that  the
vendor
will release any official updates. Previous vulnerabilities in
Quake  II
have not warranted any vendor response.

Workaround
==========
Disabling  auto  downloading  (allow_download  0)  will  mitigate
some
threats, but most of the issues listed cannot be worked around.

Fix
===
It is  strongly recommended  that any  Quake II  server operators
use an
updated  Quake   II  binary   to  fix   these  issues.   At
present, the
only known   client/server modification  which  contains  fixes
for all
these issues is R1Q2, available at
http://www.r1ch.net/stuff/r1q2/

Credits
=======
Thanks to posters on the  QuakeSrc.org message boards for
bringing  some
of these issues to light.

Richard Stanway
http://www.r1ch.net/