OSVDB ID: 7217

Title: Unreal Engine Secure Query Remote Overflow

Info

Disclosure
Jun 18, 2004

Discovery
May 24, 2004

Dates

Exploit
Jun 18, 2004

Solution
Unknown

Description

 The Unreal Engine contains a flaw that may be exploited by a malicious user to cause a buffer overflow. The issue is triggered when a remote attacker sends an excessively long value to a game server via the GameSpy 'secure' query protocol. It is possible that the flaw may allow remote code execution or denial of service.

Classification

 Location: Remote / Network Access
Attack Type: Denial of Service, Input Manipulation
Impact: Loss of Integrity, Loss of Availability
Exploit: Exploit Public, Exploit Commercial

Solution

 Upgrade to UnrealTournament 2004 version 3236 or higher, as it has been reported to fix this vulnerability. There are no other upgrades or patches known to fix the vulnerability at this time. It may be possible to correct the flaw or prevent exploitation by implementing one or more workaround(s). Links are provided as Other Solution URL's in the external references section.

Products

Epic Games, Inc.

Unreal Engine

 Unknown or Unspecified

References

Credit
  • Luigi Auriemma - aluigialtervista.org - http://aluigi.altervista.org


Direct URL: http://osvdb.org/7217