CVE-2004-2597 Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is als...
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| id software quake ii server | = 3.20 | No fix listed |
| id software quake ii server | = 3.21 | No fix listed |
References
- 20041027 Multiple Vulnerabilites in Quake II Server mailing-list
- 13013 third-party-advisory vendor-advisory
- secur1ty.net vendor-advisory
- 1011979 vdb-entry
- web.archive.org
- 11186 vdb-entry
- 11551 vdb-entry
- quake-ip-spoofing(17895) vdb-entry