PT-2004-3483 · Id · Quake Ii Server

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2592

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Quake II server versions prior to R1Q2

Description The issue allows remote attackers to cause a denial of service, resulting in an application crash. This is achieved by using a modified client that requests the server to send data stored at a negative array offset. The server fails to handle this request properly when processing Configstrings and Baselines.

Recommendations For Quake II server versions prior to R1Q2, update to version R1Q2 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2004-2592

Affected Products

Quake Ii Server

References · 10

• 🔥 http://secunia.com/advisories/13013 · Exploit
• 🔥 https://exploit-db.com/exploits/24710 · Exploit
• 🔥 http://securitytracker.com/id?1011979 · Exploit
• http://secur1ty.net/advisories/001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2592 · Security Note
• http://securityfocus.com/bid/11551 · Note
• http://osvdb.org/11181 · Note
• http://web.archive.org/web/20041130092749/www.r1ch.net/stuff/r1q2 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17890 · Note