CVE-2006-3325 Missing authorization in n/a
Remote malicious servers can overwrite protected client configuration variables, potentially leading to arbitrary file writes and code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-3325?
CVE-2006-3325 is a medium-severity missing authorization vulnerability in n/a, published on 30 Jun 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server. NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
Which versions are affected by CVE-2006-3325?
It affects 1 product.
Products include Id Software Quake 3 Engine.
How do I fix CVE-2006-3325?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2006-3325 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-3325 exists.
Public exploit code: 2 Exploit-DB entries.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2006-3325, GHSA-w943-j99v-c4q3.