CVE-2006-3325
id3 Quake 3 Engine 1.32c and Icculus Quake 3 Engine <= 810 - Arbitrary Cvar Overwrite via Server-Sent String
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-3325.
AI-analyzed exploit summary This is a functional exploit for a remote stack overflow in the Quake 3 Engine, targeting the CS_ITEMS vulnerability. It uses Microsoft Detours to hook the SV_SetConfigstring function and injects a crafted payload to overflow the buffer, leading to remote code execution.
Description
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
Exploits (2)
This is a functional exploit for a remote stack overflow in the Quake 3 Engine, targeting the CS_ITEMS vulnerability. It uses Microsoft Detours to hook the SV_SetConfigstring function and injects a crafted payload to overflow the buffer, leading to remote code execution.
This is a functional exploit for a remote stack overflow in the Quake 3 Engine's CG_ServerCommand function, targeting Soldier of Fortune II (SOF2) 1.03. It uses DLL injection and Microsoft Detours to hook the SV_SendServerCommand function, triggering a buffer overflow with a crafted payload.