q3dirtrav info

ultimateq · **Joined:** 12 Jun 2008 02:01 **Posts:** 3

Hello, I am hosting a server on W:ET 2.55. I was testing to see what exploits I am vulnerable to. I am vulnerable to the q3fill exploit. But thankfully, I don't seem to be vulnerable to the q3dirtrav exploit.

I started it up, and hit /download etmain/server.cfg and it went to my download redirect site.

I wanted to be sure that this was because my server was not vulnerable to the exploit, and not because I was doing something wrong.

The program is self explanatory, and I don't see how I could of gotten anything wrong. But any information would be appreciated.

ultimateq · **Joined:** 12 Jun 2008 02:01 **Posts:** 3

This is the error I get.

Code:

]/download etmain/server.cfg
Client download subsystem initialized
Replace existing download target file
Failed to initialize download for 'http://www.[myRedirectAddress].com/enemy-territory/etmain/server.cfg'
RE_Shutdown( 0 )]

Thanks again for help.

aluigi · **Posted:** 12 Jun 2008 07:55

as far as I know when a server uses the download www redirection (sv_wwwdownload or similar) is not possible for the client to "switch" on the quake 3 engine downloader.
So you should be enough safe

ultimateq · **Joined:** 12 Jun 2008 02:01 **Posts:** 3

Sweet. Thanks much =).

aluigi · **Posted:** 10 Aug 2008 01:01

you should make another test.
on the client set cl_wwwDownload to 0 and retry with q3dirtrav versus your server.
It's possible that with this method the bug is still exploitable.

Luigi Auriemma

q3dirtrav info