PT-2007-5623 · Epic Games · Unreal Engine

Luigi Auriemma · Publicado 2007-08-21 · Atualizado 2018-10-15 · CVE-2007-4442

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Unreal engine versions possibly 2003 and 2004

Description The issue is related to a stack-based buffer overflow in the logging function of the Unreal engine, which is used in the internal web server. This allows remote attackers to cause a denial of service, resulting in an application crash, by requesting a long .gif filename in the images/ directory. The problem is associated with the conversion from Unicode to ASCII.

Recommendations For Unreal engine versions possibly 2003 and 2004, consider disabling the logging function in the internal web server as a temporary workaround to minimize the risk of exploitation. Restrict access to the images/ directory to prevent requests for long .gif filenames.

Exploit

Correção

Identificadores relacionados

CVE-2007-4442

Produtos afetados

Unreal Engine

Referências · 9

• 🔥 https://exploit-db.com/exploits/30513 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4442 · Nota de Segurança
• http://secunia.com/advisories/26506 · Aviso do Fabricante
• http://securityfocus.com/bid/25374 · Nota
• http://aluigi.org/poc/unrwebdos.zip · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36102 · Nota
• http://securityreason.com/securityalert/3039 · Nota
• http://aluigi.org/adv/unrwebdos-adv.txt · Nota
• http://securityfocus.com/archive/1/477026/100/0/threaded · Nota