Two vulnerabilities have been reported in the Quake3 Engine, which can be exploited by malicious people to access arbitrary files on a vulnerable system and potentially to compromise a user's system.

1) A boundary error exists within the handling of the "remapShader" command. This can be exploited to cause a buffer overflow via specially crafted "remapShader" commands sent to a client.

Successful exploitation may allow arbitrary code execution, but requires that the user is e.g. tricked into connecting to a malicious game server.

The vulnerability has been reported in the following software:
* Quake III Arena 1.32b.
* Return to Castle Wolfenstein 1.41.
* Wolfenstein: Enemy Territory 2.60.

Other versions may also be affected.

2) An input validation error exists within the processing of ".pk3" file download requests from a client. This can be to download arbitrary files accessible to the server process via directory traversal attacks.

The vulnerability has been reported in the following software:
* Quake III Arena / Team Arena
* Return to Castle Wolfenstein
* Wolfenstein: Enemy Territory
* Star Trek Voyager: Elite Force

Other versions may also be affected.

Solution
Update to the fixed versions.
Further details available in Customer Area

Provided and/or discovered by
1) landser
2) Thilo Schulz and Ludwig Nussel

Changelog
Further details available in Customer Area

Original Advisory
http://www.milw0rm.com/exploits/1750

Deep Links
Links available in Customer Area