Pages: [1]
  Print  
Author Topic: Another ioquake3 vulnerability. Turning off auto-downloading recommended  (Read 1745 times)
smcv
Nub


Cakes 5
Posts: 23


ioquake3/OA/Q3 Debian maintainer


« on: March 14, 2017, 12:26:15 pm »

This ioquake3 vulnerability almost certainly affects OpenArena:

https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/

Mitigation: turn off auto-downloading.

The openarena package in Debian unstable uses Debian's copy of ioquake3, which I fixed this morning for unstable. The ioquake3 packages in Debian stable and testing will be fixed soon.

For the people who get their binaries directly from openarena.ws instead of from Linux distributions, it would be great if someone could do an OpenArena 0.8.9 (or 0.8.8.1 or whatever) engine release with the various security fixes that have happened since 0.8.alien and publish that alongside the rest of the "official" 0.8.8 downloads.

----

Editorial:

Don't use auto-downloading, and don't let your friends use auto-downloading.

Auto-downloading lets malicious server admins send you malware. Auto-downloading also lets malicious people who are not server admins send you malware (one of the OpenJK developers has tried it and reports that it isn't very difficult). The Internet has a lot of malicious people, some of them literally members of organised crime syndicates. I strongly recommend not making yourself an easy target.

While the ioquake3 maintainers are continuing to patch the worst issues, the fundamental problem remains: if auto-downloading is enabled, the idTech3 (Quake 3) engine is downloading executable code (whether in the form of QVM bytecode, or exec'able cfg files, or whatever else) over an authenticated channel, and then running it.

There is currently no way to have auto-downloading for "safe" content (like maps) without also getting auto-downloading for unsafe executable code. I'm working on it (see another topic).
Logged
fromhell
Administrator
GET A LIFE!
**********

Cakes 31
Posts: 14477



WWW
« Reply #1 on: March 14, 2017, 05:00:24 pm »

Auto-downloading's already off by default in the 0.8.8 release package (or it should be, for basic non-Free content precedents and security measures).  The OA3 engine (on the github) does not use the affected cl_renderer cvar and doesn't currently build the external renderer modules.  Also 0.8.8 predates the whole renderer module system at that

A hotfix patch could be made, but not another big full release, and i'm wondering whether that should be made on the old 0.8.8 engine or the github engine, because on the latter would probably upset some players used to 0.8.8's feel (It has a load of renderer changes not found in 088 or ioq3)


(Note for vanilla q3 players - this is not an issue in Q3)
« Last Edit: March 14, 2017, 05:19:10 pm by fromhell » Logged

asking when OA3 will be done won't get OA3 done.
Progress of OA3 currently occurs behind closed doors alone

I do not provide technical support either.

new code development on github
Neon_Knight
In the year 3000
***

Cakes 49
Posts: 3656


Trickster God.


« Reply #2 on: March 14, 2017, 05:45:53 pm »

To think there were TONS of requests for autodownload to be set on by default on OA... and now there's this, LOL.
Logged


"Level Designers are 1 part architect, 1 part artist, 1 part game designer, and 1 part beta tester!" Cliff Bleszinski
Want to contribute? Read this.
Gig
In the year 3000
***

Cakes 48
Posts: 4222


WWW
« Reply #3 on: March 15, 2017, 04:13:15 am »

There is currently no way to have auto-downloading for "safe" content (like maps) without also getting auto-downloading for unsafe executable code. I'm working on it (see another topic).
For the sake of completeness:
http://openarena.ws/board/index.php?topic=5329.0
https://github.com/ioquake/ioq3/issues/130
Logged

I never want to be aggressive, offensive or ironic with my posts. If you find something offending in my posts, read them again searching for a different mood there. If you still see something bad with them, please ask me infos. I can be wrong at times, but I never want to upset anyone.
Pages: [1]
  Print  
 
Jump to: