Bug 21580 - ioquake3 new security issue CVE-2017-11721
Summary: ioquake3 new security issue CVE-2017-11721
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard:
Keywords: advisory, feedback
Depends on:
Blocks: 20470
  Show dependency treegraph
 
Reported: 2017-08-20 20:06 CEST by David Walser
Modified: 2018-01-17 23:28 CET (History)
2 users (show)

See Also:
Source RPM: ioquake-1.36-12.20170428.1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-08-20 20:06:29 CEST
Debian has issued an advisory on August 19:
https://www.debian.org/security/2017/dsa-3948

Mageia 5 and Mageia 6 are also affected.
David Walser 2017-08-20 20:06:40 CEST

Whiteboard: (none) => MGA6TOO, MGA5TOO
Blocks: (none) => 20470

Comment 1 David Walser 2017-12-27 05:09:01 CET
We won't be fixing this for Mageia 5.

Whiteboard: MGA6TOO, MGA5TOO => MGA6TOO

Comment 2 Mike Rambo 2018-01-13 15:44:47 CET
Updated package uploaded for cauldron and Mageia 6.

Advisory:
========================

Updated ioquake3 package fixes security vulnerability:

It was discovered that ioquake3 contained a read buffer overflow that allows remote attackers to cause a denial of service (CVE-2017-11721).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11721
https://www.debian.org/security/2017/dsa-3948
========================

Updated packages in core/updates_testing:
========================
ioquake3-1.36-12.20170428.1.1.mga6
ioquake3-demo-1.36-12.20170428.1.1.mga6.noarch.rpm

from ioquake3-1.36-12.20170428.1.1.mga6.src.rpm

Version: Cauldron => 6
Assignee: rverschelde => qa-bugs
CC: (none) => mrambo
Whiteboard: MGA6TOO => (none)

Lewis Smith 2018-01-14 17:30:54 CET

Keywords: (none) => advisory

Comment 3 Lewis Smith 2018-01-14 19:17:53 CET
Testing M6/64

What is it?
"Quake 3 Arena engine (ioquake3 version)
This package contains the enhanced opensource ioquake3 version of the Quake 3
Arena engine. This engine can be used to play a number of games based on this
engine..."
This looks useful: ioquake3-demo
"This package installs an application menu entry for playing the Quake3 Arena
demo. The first time you click this menu entry, it will offer to download and
install the Quake 3 demo datafiles for you."

BEFORE update: installed:
- ioquake3-1.36-12.20170428.1.mga6.x86_64
- ioquake3-demo-1.36-12.20170428.1.mga6.noarch
and tried from the Games menu ioquake3; not successful (same from terminal, as both normal user and root): popped up a window saying:

"pak0.pk3" is missing. Please copy it from your legitimate Q3 CDROM. Point Release files are missing. Please re-install the 1.32 point release. Also check that your ioq3 executable is in the correct place and that every file in the "baseq3" directory is present and readable. See "/home/lewis/.q3a/baseq3/crashlog.txt" for details."

The log file says:
"ioq3 1.36 (git 20170428) [Mageia 12.20170428.1.mga6] linux-x86_64 May  9 2017
SSE instruction set enabled
----- FS_Startup -----
We are looking in the current search path:
/home/lewis/.q3a/baseq3
/usr/libexec/ioquake3/baseq3
----------------------
0 files in pk3 files
"pak0.pk3" is missing. Please copy it from your legitimate Q3 CDROM. Point Release files are missing. Please re-install the 1.32 point release. Also check that your ioq3 executable is in the correct place and that every file in the "baseq3" directory is present and readable

The first path cited above contains just the log file.
 $ ls -lR /home/lewis/.q3a/baseq3
 /home/lewis/.q3a/baseq3:
 -rw-r----- 1 lewis lewis 545 Ion  14 19:08 crashlog.txt

For the second path:
 $ ls -l /usr/libexec/ioquake3/baseq3
 -rwxr-xr-x 1 root root 296984 Mai   9  2017 cgamex86_64.so*
 -rwxr-xr-x 1 root root 488528 Mai   9  2017 qagamex86_64.so*
 -rwxr-xr-x 1 root root 283720 Mai   9  2017 uix86_64.so*

Not a good basis for testing the update, which has nothing to do with all this.
Asking for feedback.

CC: (none) => lewyssmith
Keywords: (none) => feedback

Comment 4 Mike Rambo 2018-01-17 14:25:59 CET
First off, I don't really know the answer to this with any certainty as I've never played the game before. That said, it appears the specified file is not bundled with ioquake3 (AFAICS, it does not exist anywhere in the ioquake3 package source) and must be obtained from some other official source.

http://wiki.ioquake3.org/Players_Guide

For mageia, urpmf says that might include the openarena and/or openarena-data packages. If you don't have the CDROM it is asking for I'd suggest installing one of those packages and then copy or synlink the file from the package you choose to one of the locations in the 'current search path' mentioned in the error message (I used /usr/libexec/ioquake3/baseq3) and then see what happens.

But, having tried this, you will then probably see a message that point release files are missing. You can get these from https://ioquake3.org/extras/patch-data/ and the unzip and copy the files in baseq3 and missionpack to the search path locations like the previous pak0 file.

When I did this I was asked for a CD key which I do not possess. But at least the program started without error.

This is the all I can think of to suggest. If this does not work we may have to wait until Remi (ioquake3 maintainer) or someone else more familiar with quake3 comes along with the real answer.
Mike Rambo 2018-01-17 14:26:08 CET

Keywords: feedback => (none)

Comment 5 Mike Rambo 2018-01-17 14:33:22 CET
I will add that running ioquake3-demo from CLI after all of the above does yield more fruitful results for me.

Ask if I didn't make something clear. If I can still remember what I did I'll try again. :)
Comment 6 Lewis Smith 2018-01-17 21:34:55 CET
@Mike
All the research you have done on this is truly impressive. I think in summary:

1) pak0.pk3. Install openarena and/or openarena-data pkgs and find in those the file; copy it to
 /usr/libexec/ioquake3/baseq3/

2) Point Release files. You can get these from
 https://ioquake3.org/extras/patch-data/
and then unzip and copy the files in baseq3 and missionpack to
 /usr/libexec/ioquake3/baseq3/

3) When launching the program you are asked for a CD key which you do not possess. But at least the program starts without error.

4) Running ioquake3-demo from CLI after all of the above does yield more fruitful results.

Before launching QA into all this, I cannot but remark "How can Mageia (or any distribution) offer packages requiring so much external fiddling for them to work?"

I think this needs feedback from probably Rémi before we bash on. If these extra-Mageia manipulations are expected and normal, they must be included in /usr/share/doc/ioquake3/
 README.md is a long very technical document.
 md4-readme.txt is also technical.
 opengl2-readme.md is a long very technical document.
 vvoip-readme.txt is also technical.
None of these (I think) cover the points you have clarified.

But thank you again Mike for beating such a tortuous path.

Keywords: (none) => feedback

Comment 7 David Walser 2018-01-17 23:28:39 CET
See Bug 6997.

Note You need to log in before you can comment on or make changes to this bug.