id Software Quake II Server Remote Information Disclosure Vulnerability

info
discussion
exploit
solution
references

id Software Quake II Server Remote Information Disclosure Vulnerability

Redix has contributed exploit details:

you must modify your q2 client, that the client will not replace the $... variables in says
quick hack:
in qcommon/cmd.c
change the line
Cmd_TokenizeString (text, true);
to
Cmd_TokenizeString( text, false);