directory traversal patch

cascade · **Joined:** 18 Nov 2008 03:56 **Posts:** 2

aluigi, can you explain how q3dirtrav works, or can you link to a patch against the q3 client?

aluigi · **Posted:** 18 Nov 2008 05:02

advisory of the original author: http://www.securityfocus.com/archive/1/ ... 0/threaded
video: http://www.youtube.com/watch?v=x0BCrjTb3aw&fmt=18

what is the patch about you refer?
the q3dirtrav can be removed setting sv_allowdownload to 0 and if you can't or don't want to disable downloads I created a patch for the bug for the Windows executables called q3dirtravfix:

http://aluigi.org/patches.htm#quake3

cascade · **Joined:** 18 Nov 2008 03:56 **Posts:** 2

is there a diff of the source of the bug fix? I'm talking about a 'patch -p0 <' patch

aluigi · **Posted:** 20 Nov 2008 12:55

the q3dirtravfix patcher is open source but naturally doesn't exist a "diff" because the patch is dynamic and the code auto adapt it to the target executable (because it's almost universal for any windows executable of game based on the quake 3 engine).

the only way to make that diff is taking the original executable and the one patched by q3dirtravfix and then getting the differences with patch or other tools.

Luigi Auriemma

directory traversal patch