[quake3] File download exploit

[James Munro]

Yep that looks like the one. In that case, sorry for the false alarm guys! I
just wanted to make sure people were aware of the problem as it still exists
in quite a few games.

Thanks for the response,

James

On Feb 12, 2008 2:37 PM, Thilo Schulz <arny at ats.s.bawue.de> wrote:

> On Dienstag, 12. Februar 2008, James Munro wrote:
> > http://rafb.net/p/XmBZ6E34.html
> >
> > The code will allow you to download any file from the server. As
> standard,
> > the Q3 server file download function does not check which directory the
> > user is downloading from, and so this code can be used to download the
> > server.cfgwhich may contain the rcon password, so it is clear why this
> > is a problem!
>
> This looks like an exploit for a bug that Ludwig Nussel and I have found
> some
> time ago already. Please look at my advisory for more information:
>
> http://seclists.org/fulldisclosure/2006/May/0225.html
>
> --
> Thilo Schulz
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://icculus.org/pipermail/quake3/attachments/20080212/d6dc93a9/attachment.htm>