Executive brief
A vulnerability in the Linux version of the Quake 2 game server allows local users to bypass file security restrictions. By manipulating a specific configuration file, an attacker with access to the system can read sensitive files they should not be able to see. This could lead to the exposure of private data or system credentials stored on the server.
Technical details
The Quake 2 server (version 3.13) on Linux fails to validate the file type or permissions of its configuration file, 'config.cfg', before processing it. A local attacker can exploit this by creating a symbolic link (symlink) from 'config.cfg' to a sensitive target file (e.g., /etc/shadow or other system files). When the server attempts to read the configuration, it follows the symlink and may disclose the contents of the target file to the attacker. This is a classic symlink race/misplacement vulnerability resulting in unauthorized information disclosure.
Affected products
- id Software Quake 2 Server 3.13
Timeline
- 1998-02-25: disclosed: Initial publication date