Yep that looks like the one. In that case, sorry for the false alarm guys! I just wanted to make sure people were aware of the problem as it still exists in quite a few games.<br><br>Thanks for the response,<br><br>James<br>
<br><div class="gmail_quote">On Feb 12, 2008 2:37 PM, Thilo Schulz <<a href="mailto:arny@ats.s.bawue.de">arny@ats.s.bawue.de</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Dienstag, 12. Februar 2008, James Munro wrote:<br>> <a href="http://rafb.net/p/XmBZ6E34.html" target="_blank">http://rafb.net/p/XmBZ6E34.html</a><br>><br>> The code will allow you to download any file from the server. As standard,<br>
> the Q3 server file download function does not check which directory the<br>> user is downloading from, and so this code can be used to download the<br></div>> server.cfgwhich may contain the rcon password, so it is clear why this<br>
> is a problem!<br><br>This looks like an exploit for a bug that Ludwig Nussel and I have found some<br>time ago already. Please look at my advisory for more information:<br><br><a href="http://seclists.org/fulldisclosure/2006/May/0225.html" target="_blank">http://seclists.org/fulldisclosure/2006/May/0225.html</a><br>
<br>--<br><font color="#888888">Thilo Schulz<br></font></blockquote></div><br>