The Unreal Engine contains a flaw that may be exploited by a malicious user to cause a buffer overflow. The issue is triggered when a remote attacker sends an excessively long value to a game server via the GameSpy 'secure' query protocol. It is possible that the flaw may allow remote code execution or denial of service.
Classification
Location:
Remote / Network Access
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Exploit:
Exploit Public
Technical
The Unreal Engine is used by multiple games. This vulnerability was published as affecting games of less than or equal to current patch versions across multiple platforms. Given both these facts, and the fact that individual titles could not verified independently by OSVDB, individual products were not listed with this entry.
The list of affected games from the original vulnerability report:
- DeusEx
- Devastation
- Mobile Forces
- Nerf Arena Blast
- Postal 2
- Rune
- Tactical Ops
- TNN Pro Hunter (?)
- Unreal 1
- Unreal II XMP
- Unreal Tournament
- Unreal Tournament 2003
- Unreal Tournament 2004
- Wheel of Time
- X-com Enforcer
The list of unaffected games from the original vulnerability report:
- America's Army
- Dead man's hand
- Magic Battlegrounds
- Rainbow Six: Raven Shield
- Splinter Cell: Pandora tomorrow
- Star Trek: Klingon Honor Guard
- Unreal Tournament 2004 >= 3236
- XIII
Please realize that more (or less) game products may or may not be affected.
Solution
Upgrade to UnrealTournament 2004 version 3236 or higher, as it has been reported to fix this vulnerability. There are no other upgrades or patches known to fix the vulnerability at this time.
It may be possible to correct the flaw or prevent exploitation by implementing one or more workaround(s). Links are provided as Other Solution URL's in the external references section.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
