RunningBon has reported two vulnerabilities in the Quake 3 Engine, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system.

1) A boundary error exist in the "CG_ServerCommand()" function when receiving long server commands. This can be exploited to cause a stack-based buffer overflow via overly long server commands sent from the server.

Successful exploitation may allow arbitrary code execution, but requires that the user is e.g. tricked into connecting to a malicious server.

Reportedly, this vulnerability only affects Soldier of Fortune II and older versions of the Quake3 engine.

2) A boundary error exists in the handling of CS_ITEMS sent from a server. This can be exploited to cause a stack-based buffer overflow by sending overly long values to the client.

Successful exploitation may allow arbitrary code execution, but requires that the user is e.g. tricked into connecting to a malicious server.

Solution
Only connect to trusted servers.

Provided and/or discovered by
RunningBon

Additional information by Luigi Auriemma.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/1976
http://milw0rm.com/exploits/1977

Deep Links
Links available to Secunia VIM customers