mailing list archives
From: glennm () MEDIAONE NET (Glenn F. Maynard)
Date: Tue, 7 Apr 1998 19:42:09 -0400
On the same note, QuakeWorld v2.10 (latest) is overflowable in the
initial "connect" sequence.
The first client->server packet gives the user name, colors, etc:
0xFF,0xFF,0xFF,0xFF followed by (plaintext) ->
There is no bounds checking on this connect; netcatting the following
will crash the server (although segfault appears trapped; no message is
displayed, and no core is left): ' connect "\x\xxxxxxxxxxxxxxxxxx'
(repeat "x" as needed; replace the first 4 spaces with 0xFF).
I've done no actual testing on the buffer length, and my assembler skills
are not enough to give an example exploit.
FTR, I've mailed Zoid (current maintainer of QW) multiple times about this
(and told him once on IRC); not once have I received a reply.
- Glenn F. Maynard
QW vulnerability Glenn F. Maynard (Apr 07)
AppleShare IP Mail Server Chris Wedgwood (Apr 08)
Geac ADVANCE library system security HOLE GAVRILIS DIMITR (Apr 02)
Re: BSD coredumps follow symlinks Nir Soffer (Apr 02)
Security hole in TMS/SMS standby (Apr 03)