PT-2003-2377 · Epic Games · Unreal Engine

Publicado

2003-12-31

·

Atualizado

2017-07-29

·

CVE-2003-1432

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Epic Games Unreal Engine versions 226f through 436
Description The issue allows remote attackers to cause a denial of service, potentially leading to CPU consumption or a crash, and may also enable the execution of arbitrary code. This can be achieved through a packet with a negative size value, which is treated as a large positive number during memory allocation, or a negative size value in a package file.
Recommendations For versions 226f through 436, as a temporary workaround, consider restricting the handling of packets with negative size values to minimize the risk of exploitation. Additionally, avoid using package files with negative size values until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94CWE-189

Identificadores relacionados

CVE-2003-1432

Produtos afetados

Unreal Engine