QUAKE 1 SOURCE PORT SOFTWARE

Responsibility for the accuracy, completeness, or usefulness of any Neither RepSec, Inc., nor any of it's employees, makesДЄny warranty, express or implied, or assumes any legal liability or The information in this document is provided as a service to customers Nvmvf6F/7xoWS5Ei4k3YKuzscxlyePNNKws6uUe2ZmwVoB+i3HHT44dOafMhAAUT MQCNAzU6dqAAAAEEAOHt9a5vevjD8ZjsEmncEbFp2U7aeqvPTcF/8FJMilgOVp75ДshXvZixHsYU7flgCNzA7wLIQPWBQBrweLG6dx9gE9e5Ca6yAJxZg8wNsi06tZfP Solution: No patches are currently available. Solution: Filter all incoming packets from the subnet 192.246.40. Quake 2, Quake 2 Linux and Quake 2 Solaris, all versions. This vulnerability is present in Quake 1, QuakeWorld, When this is exploited, no logsДЄre reported of the rcon command being used. The Quake server does not require an open connection for Have to create a handcrafted udp packet with a headerД¬ontaining the rcon command and the password 'tms' withДЄ source IP coming from ID Software's Subnet. In order for this to be exploited, the attacker would

Problem: The Quake server has a feature where it allowsДЄdministrators to remotely send commands to the QuakeД¬onsole with a password. Impact: If exploited, an attacker could remotely compromiseДЄdministrator access on any Quake server. Platforms: Quake 1/2, QuakeWorld, Linux/Solaris Quake2 Report title: Vulnerability in the Quake server I am surprised this didn't get more publicity. Quake was always a horrible security hole, but I never thought Id would stoop to introducing an intentional backdoor to allow them access to systems running Quake. Thus many Windows and UNIX boxes are affected Those running Quake 1, QuakeWorld, Quake 2, Quake 2 Linux and Quake 2 Solaris, all versions. RCON commands sent from the subnet 192.246.40.0/24 and containing the password 'tms' are automaticly executed on the server without being logged.

QUAKE 1 SOURCE PORT SOFTWARE

ID software blatantly put a backdoor in Quake 1/2 and QuakeWorld including both the Linux/Solaris Quake2.

Quake 1 source port