Executive brief
QuakeWorld is a popular multiplayer game server component. A flaw in how it handles new player connections allows a remote attacker to crash the server or potentially take control of the underlying system. This could lead to service outages for players and unauthorized access to the server hosting the game.
Technical details
A buffer overflow vulnerability exists in the connection handling logic of QuakeWorld 2.10. The server fails to perform bounds checking on the plaintext 'connect' string provided in the initial client-to-server UDP packet (prefixed with 0xFFFFFFFF). By sending an excessively long string containing connection parameters like 'name' or 'key', a remote, unauthenticated attacker can overflow a buffer on the stack. This can result in a segmentation fault (denial of service) or potentially the execution of arbitrary code with the privileges of the QuakeWorld process.
Affected products
- id Software QuakeWorld 2.10
Timeline
- 1998-04-07: disclosed: Vulnerability reported on Bugtraq mailing list.
- 1998-04-07: advisory: NVD publication date.