Hello,

Quake 3 is a popular online first person shooter developed by IDsoftware [1] 
that has been released in 1999 and is still widely played.
After the release of the source code under the GPL, the ioQuake3 project [2]
was started that is dedicated to maintaining the existing codebase.

Several game projects are using a modified version of the ioQuake3 engine.
Some of these projects are:

 - World of Padman [3]
 - Smokin' Guns [4]
 - OpenArena [5]
 - Tremulous [6]

========================================
Issue #1:

Remote shell injection vulnerability on connecting clients
========================================

This bug has been discovered by /dev/humancontroller. Parts of the
description here are also by him.

 * details

If an ioQuake3 client for UNIX-like systems connects to a malicious id Tech
3 (Point Release 1.32 compatible) server, the server can force execution of
arbitrary shell commands on the client's system.

 * CVE

CVE-2011-1412 has been assigned for this issue.

 * severity

high

 * affected OS

All UNIXoid systems, except MacOSX:
 - Linux
 - FreeBSD
 - NetBSD
 - [...]

Not affected:
 - Windows
 - MacOSX

 * games affected

 - IoQuake3 after revision 1773 and before 2097
 - World of Padman 1.5.1
 - OpenArena packaged by some Linux distributors

Other game engines based on the ioQuake3 codebase, that have merged ioQuake3
revision 1773, but not 2097, are also vulnerable.

 * workaround

No workaround.

 * proof of concept

Launch an ioQuake3 game server. Set the fs_game cvar to "`echo
TROLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLOLO
> trollme.txt`". Connect to the server with a recent ioQuake3 client for
UNIX-like systems. The client should (after failing to create a directory
with an overly long name) execute a shell command to write a file.

 * patches

Several distributors have already been contacted and have prepared patches
for their distributions.
A sourcecode patch can be got here:

  http://thilo.tjps.eu/download/patches/ioq3-svn-r2097.diff

========================================
Issue #2:

Malicious gamecode can Execute arbitrary code outside of
Q3 Virtual Machine context
========================================

This bug has been discovered by /dev/humancontroller.

 * details

The Quake3 engine uses game-specific code that is provided in a platform
independent bytecode format. This code has restricted access to
functionality provided by the engine. It should not be allowed access to
data outside the VM context.
Over the course of gameplay, the quake3 engine may dynamically load DLL
files in certain configurations. For instance, if vm_ui is set to "0" quake3
tries to open a DLL file to load the game logic behind the user interface.

Part of the functionality offered to VM logic is the possibility to write to
files within the quake3 directory. By writing a malicious DLL file, a
program residing in the VM could trigger the execution of code outside the VM
context.
To prevent this from happening, ioquake3 introduced a file extension check
in r1499 which denied writing files with certain names. However, this check
was broken and corrected in r2098 only.

This security issue has been around for a long time even in the original
quake3 engine and is not limited to ioquake3.
It affects a wide range of commercial games as well. It is only exploitable
if a user installs 3rd party addons from untrusted sources.
Quake3 was never really designed to be secure against malicious 3rd party
content, and probably isn't even in latest revisions of ioquake3. So
downloading of untrusted content is still discouraged.

 * CVE

CVE-2011-2764 has been assigned for this issue.

 * severity

medium

 * affected OS

All OS with dynamic linker

 * games affected

All games using the quake3 engine

 * workaround

Don't download and install untrusted addons. Set cl_allowdownload to 0

 * patches

Several distributors have already been contacted and have prepared patches
for their distributions.
A sourcecode patch can be got here:

  http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diff

========================================
Acknowledgements
========================================

Thanks to...

... /dev/humancontroller for reporting these bugs

... Simon McVittie for helping to coordinate the disclosure of this bug

========================================
References
========================================

[1] http://www.idsoftware.com
[2] http://www.ioquake3.org
[3] http://www.worldofpadman.com
[4] http://www.smokin-guns.net/
[5] http://www.openarena.ws
[6] http://www.tremulous.net

-- 
Thilo Schulz