Date: Mon, 29 Mar 2010 12:53:59 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security <oss-security@...ts.openwall.com>, Richard Stanway <r1ch@...h.net> Subject: CVE Request -- Quake II Server -- two security issues affecting also Alien Arena Hi Steve, vendors, (based on  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=575621) Richard Stanway posted on QuakeDev Forums page:  http://www.quakedev.com/forums/index.php?topic=53.0 two new vulnerabilities affecting also code, as present in Alien Arena (from ): A, "Multiple auto downloading DoS conditions: By supplying various invalid parameters to the download command, it is possible to cause a DoS condition by causing the server to crash. A path ending in . or / will crash on Linux. Supplying a negative offset will cause a crash on all platforms." Proposed patch: ----------------  http://corent.proboards.com/index.cgi?action=gotopost&board=bugreport&thread=4761&post=44624 Public PoC ( http://corent.proboards.com/index.cgi?action=gotopost&board=bugreport&thread=4761&post=44611): ----------- cmd download maps/tca-zion.bsp -123456789 CVSSv2 Score: 4.0/AV:N/AC:L/Au:S/C:N/I:N/A:P ------------- B, "Server-side cvar expansion: By passing an unexpanded string containing $macros to the server, the server will expand it using it's cvars. This can be used to leak sensitive information such as the rcon_password cvar." Proposed patch: N/A --------------- Richard, is there a patch for this issue yet? Public PoC:  http://www.quakedev.com/forums/index.php?topic=53.0 ----------- At the client console: "say $rcon_password" CVSSv2 Score: 4.0/ AV:N/AC:L/Au:S/C:P/I:N/A:N ------------- Regarding the B, issue -- not completely sure alienarena-server supports "server-side cvar expansion" (but assuming so). Richard, could you please clarify this? Steve, could you allocate the CVE ids for these two issues? (once issue B, confirmed). Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.