id Software Quake II Server Remote Information Disclosure Vulnerability

id Software Quake II Server Remote Information Disclosure Vulnerability

Solution:
An unofficial patch has been contributed by Redix:

change line 481 in sv_user.c to
Cmd_TokenizeString (s, false);

Unofficial updates are also available.

Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

id Software Quake II Server 3.20

BarrysWorld quake2-3.21-unofficial_server-linux.tar.gz
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/linux/qu ake2-3.21-unofficial_server-linux.tar.gz

BarrysWorld quake2-3.21-unofficial_server-source.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/quake2-3 .21-unofficial_server-source.zip

BarrysWorld quake2-3.21-unofficial_server-win32.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/win32/qu ake2-3.21-unofficial_server-win32.zip

id Software Quake II Server 3.21

BarrysWorld quake2-3.21-unofficial_server-linux.tar.gz
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/linux/qu ake2-3.21-unofficial_server-linux.tar.gz

BarrysWorld quake2-3.21-unofficial_server-source.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/quake2-3 .21-unofficial_server-source.zip

BarrysWorld quake2-3.21-unofficial_server-win32.zip
ftp://ftp.barrysworld.com/pub/games/quake2/unofficial_patches/win32/qu ake2-3.21-unofficial_server-win32.zip