Executive brief
A vulnerability in the Quake game client allows malicious game servers to take control of a player's computer. By sending specially crafted data during the connection process or via game commands, a server can bypass security protections to execute unauthorized code. This could lead to a total compromise of the player's system, including data theft or the installation of malware.
Technical details
The Quake client (version 1.09 and earlier) contains multiple stack-based buffer overflows due to unsafe string handling when parsing server-controlled data. Specifically, the client copies arbitrary-length strings into fixed 64-byte stack buffers during the precaching phase of a connection. Additionally, overflows exist in the parsing of server metadata (name and address) and the processing of the 'map' console command sent by a server. A remote attacker hosting a malicious server can exploit these vulnerabilities to overwrite the instruction pointer and execute arbitrary code on the client's machine when the user connects to the server or receives a malicious command.
Affected products
- id Software Quake Client 1.09 and earlier
Timeline
- 1998-04-08: disclosed: Initial disclosure on Bugtraq by Chris Evans
- 1998-04-08: advisory: NVD publication date