PT-2004-3489 · Id · Quake Ii Server

Published 2004-12-31 · Updated 2008-09-05 · CVE-2004-2598

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Quake II server versions prior to R1Q2

Description The issue allows remote attackers to corrupt the server's client state data structure by exiting a session without a valid disconnect command and then reconnecting. This prevents a mod from being notified of changes in the client state. The impact of this issue varies depending on the mod being used.

Recommendations For Quake II server versions prior to R1Q2, update to version R1Q2 or later to resolve the issue. As a temporary workaround, consider restricting reconnections without valid disconnect commands to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2598

Affected Products

Quake Ii Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-2598 · Security Note
• http://secur1ty.net/advisories/001 · Vendor Advisory
• http://securityfocus.com/bid/11551 · Note
• http://web.archive.org/web/20041130092749/www.r1ch.net/stuff/r1q2 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-10/0299.html · Note
• http://securitytracker.com/id?1011979 · Note