CVE-2004-2597
- State
- Published
- Severity
- Not scored
- Published
- Nov 29, 2005
- Updated
- Aug 8, 2024
- Reserved
- Nov 29, 2005
Description
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://web.archive.org/web/20041130092749/www.r1ch.net/stuff/r1q2/
- 1011979vdb-entry
- 11551vdb-entry
- 11186vdb-entry
- 13013third-party-advisory
- http://secur1ty.net/advisories/001
- quake-ip-spoofing(17895)vdb-entry
- 20041027 Multiple Vulnerabilites in Quake II Servermailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.