CVE-2008-6441 Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a mal...
HighCVSS 9.3
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) the LEVEL parameter in a WELCOME command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| epicgames unreal engine | = 2 | No fix listed |
| epicgames unreal engine | = 2.5 | No fix listed |
| epicgames unreal engine | = 3 | No fix listed |
References
- aluigi.altervista.org exploit
- 20080911 Clients format strings in the Unreal engine exploit mailing-list
- 31854 third-party-advisory vendor-advisory
- 48290 vdb-entry
- 48291 vdb-entry
- 20080911 Clients format strings in the Unreal engine mailing-list
- 31141 exploit vdb-entry
- unrealengine-dlmgr-format-string(45088) vdb-entry
- unrealengine-pkg-format-string(45089) vdb-entry
- unrealengine-welcome-format-string(45090) vdb-entry