PT-2007-5623 · Epic Games · Unreal Engine

Luigi Auriemma · Published 2007-08-21 · Updated 2018-10-15 · CVE-2007-4442

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Unreal engine versions possibly 2003 and 2004

Description The issue is related to a stack-based buffer overflow in the logging function of the Unreal engine, which is used in the internal web server. This allows remote attackers to cause a denial of service, resulting in an application crash, by requesting a long .gif filename in the images/ directory. The problem is associated with the conversion from Unicode to ASCII.

Recommendations For Unreal engine versions possibly 2003 and 2004, consider disabling the logging function in the internal web server as a temporary workaround to minimize the risk of exploitation. Restrict access to the images/ directory to prevent requests for long .gif filenames.

Exploit

Fix

Related Identifiers

CVE-2007-4442

Affected Products

Unreal Engine

References · 9

• 🔥 https://exploit-db.com/exploits/30513 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4442 · Security Note
• http://secunia.com/advisories/26506 · Vendor Advisory
• http://securityfocus.com/bid/25374 · Note
• http://aluigi.org/poc/unrwebdos.zip · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36102 · Note
• http://securityreason.com/securityalert/3039 · Note
• http://aluigi.org/adv/unrwebdos-adv.txt · Note
• http://securityfocus.com/archive/1/477026/100/0/threaded · Note