Hello,

Quake 3 is a popular online first person shooter developed by IDsoftware [1] 
that has been released in 1999 and is still widely played.
Additionally, a lot of vendors have licensed the Quake3 engine for their 
games.
A few noteworthy examples include:

 - The "Medal of Honour: Allied Assault" series
 - Star Trek Voyager Elite Force
 - Star Wars: Jedi Knight II: Jedi Outcast
 - Return to Castle Wolfenstein


========================================
Issue #1:

Remotely exploitable COM_StripExtension buffer overflow in client allows 
execution of arbitrary code.
========================================

This bug is also known as the "remapShader" bug discovered by landser who 
recently published a PoC opening a remote shell on vulnerable Linux clients at 
milw0rm.com [2]

  * details
The COM_StripExtension routine copies a given filename chopping the suffix 
into another given buffer without checking the length of that buffer.
R_FindShaderByName(), called by R_RemapShader() uses a static buffer of 64 
bytes length for the copy.
Servers can make the client execute R_RemapShader() by sending a "remapShader" 
command with too long arguments that will result in an overflowed buffer.

  * affected OS
All operating systems suffer from the bug.

  * affected games
Games using the quake3 engine that accept the remapShader command in the cgame 
code and use an otherwise unmodified COM_StripExtension().

Vulnerable are:
 - Quake3 Arena / Team Arena point release 1.32b
 - Return to Castle Wolfenstein 1.41
 - Wolfenstein: Enemy Territory 2.60

With a high probability vulnerable:
 - Star Wars: Jedi Knight 2 / 3

Not vulnerable:
 - Star Trek Voyager: Elite Force

This list can *not* be considered complete. These are the only games where I 
have done some checking or where I know they have this bug.

Probably not vulnerable are games that are based off an older version of the 
Quake3 engine where the remapShader command didn't exist in the original 
cgame code (like EliteForce).

  * workaround *
There is no known workaround except playing on trusted servers.

  * patches *
ID has released fixed binaries, but more on that later.



========================================
Issue #2:

Download of arbitrary files from servers that use setting sv_allowdownload 1
========================================

This bug was discovered by Ludwig Nussel and myself and was not publically 
disclosed until now.
CVE-2006-2082 [3] is reserved for this bug.

  * details *
Players connecting to servers that are using .pk3 files not available on the 
client have the possibility to download the missing files from the server if 
that server allows it.
The client then explicitly requests a filename to download. Unfortunately, the 
server does no checking of the filename at all allowing modified clients to 
download any files via directory traversal like 
"../../../../../../../etc/passwd"
with the rights of the user the server runs under.

  * affected OS *
All operating systems are affected

  * affected games *
As long as game developers haven't heavily modified that part of the server 
code, it is safe to say that most of Quake3 engine based games are 
vulnerable. To test all available games is beyond my resources, but I can say 
with certainty that these games are affected:

 - Quake3 Arena / Team Arena
 - Return to Castle Wolfenstein
 - Wolfenstein: Enemy Territory (note: the URL referral downloading method is
   not affected.)
 - Star Trek Voyager: Elite Force

IDsoftware has confirmed that games using the Doom3 engine are not vulnerable 
to this particular bug.

  * workaround *
Set the sv_allowdownload cvar to 0 on your server which prohibits downloading 
of any files.


========================================
Patches:
========================================

IDsoftware has released new packages containing builds that fix both issues 
for these games:

 - Quake3 Arena / Team Arena
 - Return to Castle Wolfenstein
 - Wolfenstein: Enemy Territory

Check out idsoftware's news page [1] and their ftp server [4].

You can also check out the icculus.org/quake3 project [5] that has both issues 
fixed in the latest SVN repository [6] (rev. 777 as of this writing). Updated 
binaries will be released soon.


========================================
Acknowledgements
========================================

Thanks to..

... landser and the milw0rm people to make the remapShader bug public.

... Ludwig for coordinating disclosure and having the idea about bug #2 in 
the first place.

... the other guys at icculus.org (zakk, timbo, ryan to name a few) for having 
come so far with debugging/cleaning up/porting the original 1.32b source 
release for various platforms.

... Timothee Besset and the guys at idsoftware to still release fixed builds 
for a more than 6 years old game (which is important because of Punkbuster 
support).

========================================
Links
========================================

[1] http://www.idsoftware.com
[2] http://milw0rm.com/exploits/1750
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2082
[4] ftp://ftp.idsoftware.com/idstuff/
[5] http://icculus.org/quake3/
[6] http://svn.icculus.org/quake3/trunk/

-- 
Thilo Schulz