CVE-2007-5248 Multiple format string vulnerabilities in the ID Software Doom 3 engine, as used by Doom 3 1.3.1 and earlier, Quake 4 1.4.2 and earlier, and Prey 1.3 and earlier, when Punkbuster (PB) is enabled, allo...
HighCVSS 9.3
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple format string vulnerabilities in the ID Software Doom 3 engine, as used by Doom 3 1.3.1 and earlier, Quake 4 1.4.2 and earlier, and Prey 1.3 and earlier, when Punkbuster (PB) is enabled, allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in (1) a PB_Y packet to the YPG server or (2) a PB_U packet to UCON. NOTE: this issue might be in Punkbuster itself, but there are insufficient details to be certain.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| id software doom 3 | <= 1.3.1 | No fix listed |
| id software quake 4 | <= 1.4.2 | No fix listed |
| take2games prey | <= 1.3 | No fix listed |
References
- aluigi.altervista.org exploit
- aluigi.org exploit
- 27002 third-party-advisory vendor-advisory
- 27023 third-party-advisory vendor-advisory
- 27036 third-party-advisory vendor-advisory
- 3196 third-party-advisory
- 20071001 Format string in the Doom 3 engine through PB mailing-list
- 25893 vdb-entry
- ADV-2007-3333 vdb-entry
- doom3engine-punkbuster-format-string(36899) vdb-entry