CVE-2010-5077 server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a...
HighCVSS 7.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openarena(Debian:12) | < 0.8.5-6 | 0.8.5-6 |
| debian/openarena(Debian:13) | < 0.8.5-6 | 0.8.5-6 |
| debian/openarena(Debian:14) | < 0.8.5-6 | 0.8.5-6 |
| ioquake3 engine | <= r1761 | No fix listed |
| openarena | All versions | No fix listed |
| tremulous | All versions | No fix listed |
References
- Debian Security Tracker CVE-2010-5077 vendor-advisory
- openarena.ws
- permalink.gmane.org
- DSA-2442 vendor-advisory
- www.ioquake.org
- [oss-security] 20120326 Re: CVE-2010 Request: quake3 / openarena-server: DDoS by processing 'getstatus' and 'rcon' packets mailing-list
- 20120326 Traffic amplification via Quake 3-based servers mailing-list
- www.urbanterror.info
- bugs.debian.org
- bugs.debian.org issue-tracking