PT-2004-3488 · Id · Quake Ii Server

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2597

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Quake II server versions prior to R1Q2

Description The issue allows remote attackers to bypass IP-based access control rules by sending a userinfo string that contains an ip key/value pair and is long enough to cause a new key/value pair to be truncated. This truncation interferes with the server's ability to find the client's IP address.

Recommendations For Quake II server versions prior to R1Q2, consider updating to version R1Q2 or later to resolve the issue. As a temporary workaround, consider restricting access to the server or implementing additional access control measures to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2597

Affected Products

Quake Ii Server

References · 9

• http://secunia.com/advisories/13013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2597 · Security Note
• http://secur1ty.net/advisories/001 · Vendor Advisory
• http://securityfocus.com/bid/11551 · Note
• http://osvdb.org/11186 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17895 · Note
• http://web.archive.org/web/20041130092749/www.r1ch.net/stuff/r1q2 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html · Note
• http://securitytracker.com/id?1011979 · Note