CVE-2010-2702 Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, R...
HighCVSS 9.3
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield, and SWAT4, when downloads are enabled, allows remote attackers to execute arbitrary code via a long LEVEL field in a WELCOME response to a download request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| epicgames unreal engine | = 1 | No fix listed |
| epicgames unreal engine | = 2 | No fix listed |
| epicgames unreal engine | = 2.5 | No fix listed |
| epicgames postal 2 | All versions | No fix listed |
| epicgames raven shield | All versions | No fix listed |
| epicgames swat 4 | All versions | No fix listed |
| epicgames unreal tournament 2003 | All versions | No fix listed |
| epicgames unreal tournament 2004 | All versions | No fix listed |
References
- aluigi.altervista.org exploit
- aluigi.org exploit
- 66039 vdb-entry
- 40466 third-party-advisory vendor-advisory
- unrealengine-ugameengineupdate-bo(60142) vdb-entry