CVE-2006-3324 Path traversal in n/a
Remote attackers can overwrite arbitrary files in the game directory via a buffer overflow in the automatic downloading feature of the Quake 3 engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-3324?
CVE-2006-3324 is a medium-severity path traversal vulnerability in n/a, published on 30 Jun 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
Which versions are affected by CVE-2006-3324?
It affects 1 product.
Products include Id Software Quake 3 Engine.
How do I fix CVE-2006-3324?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2006-3324 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-3324 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2006-3324, GHSA-86g9-3p64-q3xg.