CVE-2017-6903: Insufficient Information (NVD-CWE-noinfo)
value: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2017-03-14T22:59Z
Repository: https://github.com/ioquake/ioq3
Language: C
Files changed: code/client/cl_main.c, code/qcommon/files.c, code/sys/sys_main.c
Commit date: 2017-03-13 14:14:00 -0700
Commit message: Don't load .pk3s as .dlls, and don't load user config files from .pk3s.

Diff: diff --git a/code/client/cl_main.c b/code/client/cl_main.c
index b68d4f99..31dd9ab7 100644
--- a/code/client/cl_main.c
+++ b/code/client/cl_main.c
@@ -3198,11 +3198,11 @@ void CL_InitRef( void ) {
 #endif
 
 	Com_Printf( "----- Initializing Renderer ----\n" );
 
 #ifdef USE_RENDERER_DLOPEN
-	cl_renderer = Cvar_Get("cl_renderer", "opengl2", CVAR_ARCHIVE | CVAR_LATCH);
+	cl_renderer = Cvar_Get("cl_renderer", "opengl2", CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED);
 
 	Com_sprintf(dllName, sizeof(dllName), "renderer_%s_" ARCH_STRING DLL_EXT, cl_renderer->string);
 
 	if(!(rendererLib = Sys_LoadDll(dllName, qfalse)) && strcmp(cl_renderer->string, cl_renderer->resetString))
 	{
@@ -3549,11 +3549,11 @@ void CL_Init( void ) {
 
 	cl_showMouseRate = Cvar_Get ("cl_showmouserate", "0", 0);
 
 	cl_allowDownload = Cvar_Get ("cl_allowDownload", "0", CVAR_ARCHIVE);
 #ifdef USE_CURL_DLOPEN
-	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE);
+	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE | CVAR_PROTECTED);
 #endif
 
 	cl_conXOffset = Cvar_Get ("cl_conXOffset", "0", 0);
 #ifdef __APPLE__
 	// In game video is REALLY slow in Mac OS X right now due to driver slowness
diff --git a/code/qcommon/files.c b/code/qcommon/files.c
index 92a9e405..27f5713d 100644
--- a/code/qcommon/files.c
+++ b/code/qcommon/files.c
@@ -1362,16 +1362,22 @@ separate file or a ZIP file.
 */
 long FS_FOpenFileRead(const char *filename, fileHandle_t *file, qboolean uniqueFILE)
 {
 	searchpath_t *search;
 	long len;
+	qboolean isLocalConfig;
 
 	if(!fs_searchpaths)
 		Com_Error(ERR_FATAL, "Filesystem call made without initialization");
 
+	isLocalConfig = !strcmp(filename, "autoexec.cfg") || !strcmp(filename, Q3CONFIG_CFG);
 	for(search = fs_searchpaths; search; search = search->next)
 	{
+		// autoexec.cfg and q3config.cfg can only be loaded outside of pk3 files.
+		if (isLocalConfig && search->pack)
+			continue;
+
 		len = FS_FOpenFileReadDir(filename, search, file, uniqueFILE, qfalse);
 
 		if(file == NULL)
 		{
 			if(len > 0)
diff --git a/code/sys/sys_main.c b/code/sys/sys_main.c
index 2ccf3020..6d7fe7bf 100644
--- a/code/sys/sys_main.c
+++ b/code/sys/sys_main.c
@@ -498,10 +498,17 @@ from executable path, then fs_basepath.
 
 void *Sys_LoadDll(const char *name, qboolean useSystemLib)
 {
 	void *dllhandle;
 	
+	// Don't load any DLLs that end with the pk3 extension
+	if (COM_CompareExtension(name, ".pk3"))
+	{
+		Com_Printf("Rejecting DLL named \"%s\"", name);
+		return NULL;
+	}
+
 	if(useSystemLib)
 		Com_Printf("Trying to load \"%s\"...\n", name);
 	
 	if(!useSystemLib || !(dllhandle = Sys_LoadLibrary(name)))
 	{

Vulnerable code: 	cl_renderer = Cvar_Get("cl_renderer", "opengl2", CVAR_ARCHIVE | CVAR_LATCH);
	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE);
Fixed code: 	cl_renderer = Cvar_Get("cl_renderer", "opengl2", CVAR_ARCHIVE | CVAR_LATCH | CVAR_PROTECTED);
	cl_cURLLib = Cvar_Get("cl_cURLLib", DEFAULT_CURL_LIB, CVAR_ARCHIVE | CVAR_PROTECTED);
	qboolean isLocalConfig;
	isLocalConfig = !strcmp(filename, "autoexec.cfg") || !strcmp(filename, Q3CONFIG_CFG);
		// autoexec.cfg and q3config.cfg can only be loaded outside of pk3 files.
		if (isLocalConfig && search->pack)
			continue;

	// Don't load any DLLs that end with the pk3 extension
	if (COM_CompareExtension(name, ".pk3"))
	{
		Com_Printf("Rejecting DLL named \"%s\"", name);
		return NULL;
	}