The Unreal Engine contains a flaw that may be exploited by a malicious user to cause a buffer overflow. The issue is triggered when a remote attacker sends an excessively long value to a game server via the GameSpy 'secure' query protocol. It is possible that the flaw may allow remote code execution or denial of service.

The Unreal Engine is used by multiple games. This vulnerability was published as affecting games of less than or equal to current patch versions across multiple platforms. Given both these facts, and the fact that individual titles could not verified independently by OSVDB, individual products were not listed with this entry.

The list of affected games from the original vulnerability report:

- DeusEx
- Devastation
- Mobile Forces
- Nerf Arena Blast
- Postal 2
- Rune
- Tactical Ops
- TNN Pro Hunter (?)
- Unreal 1
- Unreal II XMP
- Unreal Tournament
- Unreal Tournament 2003
- Unreal Tournament 2004
- Wheel of Time
- X-com Enforcer

The list of unaffected games from the original vulnerability report:

- America's Army
- Dead man's hand
- Magic Battlegrounds
- Rainbow Six: Raven Shield
- Splinter Cell: Pandora tomorrow
- Star Trek: Klingon Honor Guard
- Unreal Tournament 2004 >= 3236
- XIII

Please realize that more (or less) game products may or may not be affected.

Upgrade to UnrealTournament 2004 version 3236 or higher, as it has been reported to fix this vulnerability. There are no other upgrades or patches known to fix the vulnerability at this time.

It may be possible to correct the flaw or prevent exploitation by implementing one or more workaround(s). Links are provided as Other Solution URL's in the external references section.

• Security Tracker: 1010535
• Bugtraq ID: 10570
• Secunia Advisory ID: 11900 12091
• ISS X-Force ID: 16451
• CVE ID: 2004-0608 (see also: NVD)
• SCIP VulDB ID: 722
• Keyword: epic UDP port 7777 UDP port 7787
• Other Advisory URL: http://aluigi.altervista.org/adv/unsecure-adv.txt
  http://www.securiteam.com/windowsntfocus/5BP0P0AD5W.html
• Other Solution URL: http://aluigi.altervista.org/adv/unsecure-adv.txt
  http://archives.neohapsis.com/archives/bugtraq/2004-06/0375.html
  http://isc.sans.org/diary.php?date=2004-06-22
  http://www.gdries.com/IpServer.u
• Generic Exploit URL: http://immunitysec.com
• Packet Storm: http://packetstormsecurity.org/0406-advisories/unrealCodeExec.txt
  http://packetstormsecurity.org/0406-exploits/unsecure.zip
• Vendor Specific Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200407-14.xml

• Luigi Auriemma - aluigialtervista.org - http://aluigi.altervista.org