Quake 3 Arena allows gamers among to fight each others in virtual arenas created for the Quake game. This application contains a vulnerability that allows attackers to crash the server remotely.
Vulnerable systems:
Quake 3 Arena version 1.29f
Quake 3 Arena version 1.29g
Immune systems:
Quake 3 Arena version 1.17
A security vulnerability has been found in Quake 3 Arena. The vulnerability allows an attacker to cause the server to crash.
The vulnerability can be reproduced by initiating a connection to the server and then sending the following sequence:
????connectre
Where those four strange character (Y with the dots on them) are char(255)'s.
Temporary solution:
A quick way to ensure that your server will be up is to revert back to version 1.17.
Exploit:
/* This is a 1.29f and 1.29g Server Exploit for id software's Quake3: Arena.
Basically this connects to the default port 27960 of a server and sends a udp
packet with a string of Char(255) four times plus connect, all as one word.
This is a working Linux version, simple enough to use: ./fuq3 <hostname>
I am no way going to continue to work on this it works it has done. It is proven.
Therefore, here is the bare minimum. Thanks to ttol and his information, this was achieved. There is also a working hack that can be done with netcat, you use netcat
with the -u (UDP option) connect to the host, and then you send the string.
*/
