CVE-2012-3345 symlink attack in ioquake3 >= r1773

Background
==========
 
ioquake3 [IOQ] is a fork of the Quake III Arena (id Tech 3) game engine,
and has become the de facto upstream for that engine since id Software
ceased to develop it. It is also used (unmodified, modified or forked)
in various open-source and proprietary games including OpenArena [OA],
Reaction [REA], Smokin’ Guns [SGN], Tremulous [TREM], Turtle Arena [TA],
Urban Terror [URT] and World of Padman [WOP].
 
Vulnerability
=============
 
Access vector: local
Authentication required: local system
Impact: overwrite a file owned by the victim with a predictable integer
 
Since svn revision 1773, ioquake3 has written its process ID to the file
/tmp/ioq3.pid (or ioq3.pid in a world-writeable location) under the
following circumstances:
 
* running on non-Mac Unix and TMPDIR not set, or set to a
world-writeable location; or
* running on Mac OS and FSFindFolder() for a temporary directory fails
or returns a world-writeable location
 
On a multi-user system, an attacker could create a symbolic link
/tmp/ioq3.pid pointing to any file owned by a user who plays an
ioquake3-based game. When the victim runs ioquake3, the target file will
be overwritten and replaced with the process ID of ioquake3.
 
The effect of this attack depends on the file being overwritten: it
could be simple vandalism (destroy one of the victim’s files), or it
could have further security implications if knowledge of the contents of
a target file is used for authentication (in a system similar to
pam_dotfile [DOT], for instance).
 
For the dedicated server, the process ID is written to ioq3_server.pid,
but the attack is essentially the same. For forks of ioquake3, the
filename will typically include the name of the fork, e.g. openarena.pid.
 
Affected versions
=================
 
* ioquake3 >= svn r1773
* ioquake3 < svn r2253
* OpenArena 0.8.8
* Reaction beta 1.0
* Smokin’ Guns 1.1
* Tremulous “trunk” >= svn r2125
* Tremulous “gpp” >= svn r2140
* Turtle Arena >= svn r204 (all releases named Turtle Arena)
* World of Padman >= 1.5.2 beta
 
Unaffected versions
===================
 
* ioquake3 1.36
* ioquake3 <= svn r1772
* ioquake3 >= svn r2253
* OpenArena <= 0.8.5
* Smokin’ Guns <= 1.1b4
* Tremulous “trunk” <= svn r2124
* Tremulous “gpp” <= svn r2139
* Tremulous GPP1
* Tremulous <= 1.1.0
* Turtle Arena <= svn r203
* TMNT Arena 20091211 (former name of Turtle Arena)
* ioUrbanTerror 2007-12-20 client
* ioUrbanTerror 2007-12-20 server
* World of Padman <= 1.5.0
 
Solution
========
 
The attached patches have been reviewed by two ioquake3 maintainers.
Please apply them to affected versions on or after the embargo date.
 
Patch 0001 fixes the vulnerability by writing the pid file into the
ioquake3 user’s home directory (e.g. ~/.q3a/ioq3.pid for an unmodified
engine with default configuration) instead of the temporary directory.
 
Patch 0002 is recommended, but not strictly necessary to fix the
vulnerability. It removes the functions to get the temporary directory,
as a precaution against other unsafe uses.
 
 
References
==========
 

Calling all content creators!

Work has started on “baseio“, a project to create a small game to include with the ioquake3 engine download with Creative Commons licensed content. Work has already been started on textures, weapon models, and a player model, but there is still much to be done. Animations, mapping, and audio are most needed, but if there’s anything you can contribute, join the discussion. Any content contributed must be under a Creative Commons nonccommercial-by-sharealike license. The ioquake3 code base and any contributed code will remain GPL. We also need some people who have lead mods before since we’ve run out of beer so now we’re too sober to know what to do.

Turtle Arena 0.6 Released!

Boasting better than HD graphics, the Turtle Arena team have released version 0.6 of their Turtle-Powered video game.

Here’s what’s new:

  • Four player splitscreen!
  • The turtles now have tails, like in the original TMNT comics.
  • Added cel-shading to many 3D models (code from ZEQ2-lite)
  • Remade many images at higher resolution (most or all UI/HUD graphics are “HD”)
  • TrueType fonts are used by default and are rendered to screen size (always look nice).
  • Redesigned main HUD area.
  • Added joystick select menu.
  • Created new texture for Overload base.
  • Possible to play while hosting an internet server using the game client.
  • Team name is now colorized in team play messages.
  • Now uses dpmaster protocol, instead of quake3 master protocol, keeps the game separate on master server.
  • Automatically choose next map in multiplayer using scripts/arenas.txt (and scripts/*.arena), allows new maps to be automatically be added to map rotation.
  • Lots of fixes from ioquake3 contributers, updated from ioq3 revision 1794 to 2236.
  • …and many other bug fixes and improvement!

You can download Z Turtle Arena for Windows or Linux. Order some pizza while you do so.

Reaction Beta 1

reaction

The first beta standalone release of Reaction, an ioquake3-based Action Quake 2-styled game is now available.

Previously, Reaction required a full install of Quake 3: Arena to play.

If you’ve never played Action Quake 2, you should know that it was in the style of your favorite realistic action movies. Guns akimbo, headshots, ridiculous trick jumps, and more await you.

You can check it out here.

 

(This is not an April fools joke)

 

ioquake3 (kwaak3) on the Droid & G1

Via Thunderbird’s excellent kwaak3 ioquake3 spin-off, I just tried out ioquake3 on a borrowed Verizon Droid (Motorola Milestone). I’ve also tried kwaak3 on a donated T-Mobile G1 (HTC Dream):

it is truly amazing that ioquake3 can run well on these platforms, not just for first-person-shooters or doom clones, but for new kinds of games to have a stable engine for many, many platforms.

Relnav’s Quake 3 Announcement

THIS WAS AN APRIL FOOLS JOKE!

San Francisco, CA – After over four and a half years of serving the Quake 3 community, the developers have behind ioquake3 have decided to make some changes. Citing the need to keep with the future and keep up with the community’s demands, the ioquake3 team has teamed up with Relnav of the Relnav’s Quake 2 project. With this, several changes will be made:

  • ioquake3 will be renamed to Relnav’s Quake 3
  • The principal development platform will be Windows 7 and Direct3D 11
  • Legacy suport for Mac OS X and Linux will be provided by the WINE emulation software project.
  • The multiplayer subsystem has been rewritten and a new, written-from-scratch, anti-cheat system has been created.

The first release of Relnav’s Quake 3 will be made available in the next few days. Due to the anti-cheat system, source-code releases have been suspended for the forseeable future.

We’ve already provided a few mod teams with a prerelease version of Relnav’s Quake 3, and we’re excited to see what people can do with it.
One particularly promising mod team has created a mod in the Goldeneye: 007 style but using the CSI: Miami universe! It is really quite amazing.

The Relnav’s Quake 3 team thanks you for your continued support and looks forward to the next five years!

ioquake3 hosting fundraiser

Update: We’ve met our goal, the drive has ended. Thank you again for all your help!

Donations are required for ioquake3’s hosting to continue every two years. Next month, ioquake3’s hosting bill comes due. Fortunately it is only due once every two years which means that requests for donations will be infrequent.

Thank you for your support.

ioquake3 1.36 in the news!

Since the release of ioquake3 1.36 we’ve had a lot of attention from various sites and I thought it would be nice for people who only read ioquake3 to check out the reaction we’ve gotten in comments on some other places:

Slashdot was by far the leader in both legitimate comments, visits back to ioquake3.org, and trolling. Of course in preparing a Slashdot post at around 1AM I made a huge blunder in attempting to make a joke about Quake Live, which is a great game and I encourage everyone to check out now that the queues have been eliminated.

ioquake3 was even featured around the 16:30 mark on the MODSonair video podcast:

MODSonair Episode 177 on Vimeo.

By far the best reaction was the decision of the Smoking Guns team to start experimenting with ioquake3 as you can see over at their site.

Yee haw!

A few people were confused about what Mumble is, for them I would suggest that they check out the comparison article over at TimeDoctor Dot Org.

The biggest issue ioquake3 faces with public reception is the problem of having content built-in for people to play that does not require the Quake 3 data.

Be assured that we’re working on this though we could really use your help in coming up with content under the creative commons license and game code under the GPL. Please get in touch with us or contact me directly (zachary [at] ioquake.org) if you’re interested.

ioquake3 1.36 Gone Gold

ioquake3 1.36 is here!

Go get it as a package for your system, or a source zip file/tarball. Check out your options for help if you run into a problem. If you find any bugs, please search bugzilla, and then report them!

Here is what you can do with ioquake3:

  • Play Quake 3: Arena and the expansion, Quake 3: Team Arena
  • Make your own game!
  • Play standalone games like Urban Terror and Tremulous.
  • Play older Quake 3 mods without the Quake 3 security issues but with new features.

voipHave a look at the list of improvements that have gone into this release:

  • Ports to new platforms
  • Off-server data downloads (http redirection) via HTTP and FTP with cURL
  • OpenAL sound rendering allowing for surround (5.1 and 7.1) speaker layouts and generally improved sound
    quality. Especially on the Windows Vista Operating System.
  • Ogg Vorbis audio decoding.
  • In-engine VOIP support, with optional Mumble player-location (positional audio) support.
  • IPV6 Networking. We’re ready to frag on the net of the future!
  • SDL backend for the OpenGL context, window management, and input. This also improves portability.
  • Anaglyph stereo rendering (for viewing with 3D glasses)
  • Full x86-64 architecture support
  • Rewritten PowerPC JIT compiler, with ppc64 support
  • New SPARC JIT compiler, with support for both sparc32 and sparc64
  • Compilation with MinGW and cross-compilation for Windows from Linux
  • Improved console command auto-completion
  • Persistent console command history
  • Improved QVM (Quake Virtual Machine) tools
  • Colored terminal output on POSIX operating systems
  • GUID System
  • Multiuser support on Windows systems (user-specific game data is stored in their respective Application Data folders)
  • PNG format support for textures
  • Numerous security fixes

If you’re interested in following more updates with ioquake3, follow our twitter feed , and please do digg/reddit/slashdot this post! Please!

Join us on our forums, mailing lists, irc, etc at the discussion page!

Write just about anything about ioquake3 on the wiki!

Talk with us on our mumble server at mumble.ioquake3.org

Thanks again to everyone who has made this a spectacular release. What do you want to see in the future of ioquake3? 4-Player Split-Screen? Let us know in the comments.

vi-oquake3

Effectively immediately ioquake3 will be dropping the established rendering path of OpenGL and moving directly into the future of gaming, rendering through a text editor. We realize this decision may come as shocking to some, but with increased competition from browser-based games like id software’s Quake Live, we must compete on a whole new level.

So, I have started by creating an SVN branch for the new rendering conduit and all support for OpenGL rendering will be dropped along with LibSDL support. We’re especially happy about dropping LibSDL support since we realize that everyone who has used our LibSDL version of Icculus Quake has hated the mouse responsiveness and the way it inserts DRM into the rendering channel. Eliminating that kind of drama will really set the project free.

Therefor, I present to you, the gaming public, and screaming Icculus Quake 3 fanboys, VI-OQUAKE3:

(screen shot after the break)

Continue reading “vi-oquake3”