PT-2004-3488 · Id · Quake Ii Server

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2597

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Quake II server versions prior to R1Q2

Description The issue allows remote attackers to bypass IP-based access control rules by sending a userinfo string that contains an ip key/value pair and is long enough to cause a new key/value pair to be truncated. This truncation interferes with the server's ability to find the client's IP address.

Recommendations For Quake II server versions prior to R1Q2, consider updating to version R1Q2 or later to resolve the issue. As a temporary workaround, consider restricting access to the server or implementing additional access control measures to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-2597

Produtos afetados

Quake Ii Server

Referências · 9

• http://securityfocus.com/bid/11551 · Nota
• http://secunia.com/advisories/13013 · Aviso do Fabricante
• http://osvdb.org/11186 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17895 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2597 · Nota de Segurança
• http://secur1ty.net/advisories/001 · Aviso do Fabricante
• http://web.archive.org/web/20041130092749/www.r1ch.net/stuff/r1q2 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html · Nota
• http://securitytracker.com/id?1011979 · Nota