PT-2011-4250 · World Of Padman Team+3 · World Of Padman+3

Published 2011-08-09 · Updated 2018-10-09 · CVE-2011-3012

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ioQuake3 engine versions prior to the version used in World of Padman 1.2 World of Padman versions 1.2 and earlier Tremulous version 1.1.0 ioUrbanTerror version 2007-12-20

Description The issue allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file. This is achieved by exploiting the engine's failure to check for dangerous file extensions before writing to the quake3 directory.

Recommendations For ioQuake3 engine versions prior to the version used in World of Padman 1.2, consider restricting access to the quake3 directory to prevent arbitrary code execution. For World of Padman versions 1.2 and earlier, restrict the installation of third-party addons to minimize the risk of exploitation. For Tremulous version 1.1.0, avoid using third-party addons until a fix is available. For ioUrbanTerror version 2007-12-20, consider disabling the ability to write to the quake3 directory as a temporary workaround.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-3012

Affected Products

Tremulous

World Of Padman

Ioquake3

Iourbanterror

References · 15

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html · Exploit
• https://security.gentoo.org/glsa/201706-23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3012 · Security Note
• https://osv.dev/vulnerability/CVE-2011-3012 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-3012 · Security Note
• https://ubuntu.com/security/CVE-2011-3012 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=725951 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3012 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3012 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-3012 · Vendor Advisory
• http://securityfocus.com/archive/1/519051/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68870 · Note
• http://securityfocus.com/bid/48915 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69164 · Note
• http://securityreason.com/securityalert/8324 · Note