CVE-2004-2592 Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (application crash) via a modified client that asks the server to send data stored at a....
MediumCVSS 5.0
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (application crash) via a modified client that asks the server to send data stored at a negative array offset, which is not handled when processing Configstrings and Baselines.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| id software quake ii server | = 3.20 | No fix listed |
| id software quake ii server | = 3.21 | No fix listed |
References
- 20041027 Multiple Vulnerabilites in Quake II Server mailing-list
- 13013 exploit third-party-advisory vendor-advisory
- secur1ty.net vendor-advisory
- 1011979 exploit vdb-entry
- web.archive.org
- 11181 vdb-entry
- 11551 vdb-entry
- quake-configstrings-baselines-dos(17890) vdb-entry