CVE-2011-2764
The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 8.69% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- ioquake3/ioquake3 engine · openarena/openarena · smokin-guns/smokin\' guns · tremulous/tremulous · urbanterror/iourbanterror · worldofpadman/world of padman
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.htmlExploit
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html
- http://secunia.com/advisories/45539
- http://secunia.com/advisories/45540
- http://securityreason.com/securityalert/8324
- http://svn.icculus.org/quake3?view=rev&revision=2098Patch
- http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diffPatch
- http://www.securityfocus.com/archive/1/519051/100/0/threaded
- http://www.securityfocus.com/bid/48915
- https://bugzilla.redhat.com/show_bug.cgi?id=725951Exploit, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68870
- https://security.gentoo.org/glsa/201706-23
- http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.htmlExploit
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html
- http://secunia.com/advisories/45539
- http://secunia.com/advisories/45540
- http://securityreason.com/securityalert/8324
- http://svn.icculus.org/quake3?view=rev&revision=2098Patch
- http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diffPatch
- http://www.securityfocus.com/archive/1/519051/100/0/threaded
- http://www.securityfocus.com/bid/48915
- https://bugzilla.redhat.com/show_bug.cgi?id=725951Exploit, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68870
- https://security.gentoo.org/glsa/201706-23
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.