CVE-2011-2764

Published: Aug 4, 2011Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.

Affected (7)

Products: Ioquake3: Ioquake3 Engine · Openarena: Openarena · Smokin Guns: Smokin' Guns · +3 more

Show all products

Ioquake3: Ioquake3 Engine · Openarena: Openarena · Smokin Guns: Smokin' Guns · Tremulous: Tremulous · Urbanterror: Iourbanterror · Worldofpadman: World Of Padman

1 product

Ioquake3 Engine

1 product

1 product

1 product

1 product

1 product

World Of Padman

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Ioquake3 Ioquake3 Engine	Up to 1.36
Ioquake3 Ioquake3 Engine	Version 1.36 rc1
Openarena Openarena	All versions
Smokin Guns Smokin' Guns	All versions
Tremulous Tremulous	All versions
Urbanterror Iourbanterror	All versions
Worldofpadman World Of Padman	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (24)

http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html

Source: cve@mitre.org

Exploit

http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html

Source: cve@mitre.org

http://secunia.com/advisories/45539

Source: cve@mitre.org

http://secunia.com/advisories/45540

Source: cve@mitre.org

http://securityreason.com/securityalert/8324

Source: cve@mitre.org

http://svn.icculus.org/quake3?view=rev&revision=2098

Source: cve@mitre.org

Patch

http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diff

Source: cve@mitre.org

Patch

http://www.securityfocus.com/archive/1/519051/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/48915

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=725951

Source: cve@mitre.org

ExploitPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/68870

Source: cve@mitre.org

https://security.gentoo.org/glsa/201706-23

Source: cve@mitre.org

http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/45539

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/45540

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/8324

Source: af854a3a-2127-422b-91ae-364da2661108

http://svn.icculus.org/quake3?view=rev&revision=2098

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diff

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/archive/1/519051/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/48915

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=725951

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/68870

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201706-23

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.