CVE:CVE-2006-3325
CNNVD:CNNVD-200606-604
id3 Quake 3 Engine 1.32c和Icculus Quake 3 Engine (ioquake3) 810修订版及更早版本中的client/cl_parse.c，可让远程恶意服务器通过从服务器发送的cvar名称和值字符串覆盖客户机上任意写保护的cvar变量，例如关于自动下载的cl_allowdownload和关于quake3路径的fs_homepath。
solution:Upgrade id_software quake_3_engine to a higher version than *,1.32b,1.32c,icculus_803,icculus_804,icculus_805,icculus_806,icculus_807,icculus_808,icculus_809,icculus_810,and avoid the version 1.32b,1.32c,icculus_803,icculus_804,icculus_805,icculus_806,icculus_807,icculus_808,icculus_809,icculus_810