Unscored severity · published Mar 9, 2009
CVE-2008-6441
Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) the LEVEL parameter in a WELCOME command.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unreal Engine · Epicgames
2; 2.5; 3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6441
Exploit
http://aluigi.altervista.org/adv/unrealcfs-adv.txt
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0190.html
Vendor Advisory
http://secunia.com/advisories/31854
www.osvdb.org
http://www.osvdb.org/48290
www.osvdb.org
http://www.osvdb.org/48291
www.securityfocus.com
http://www.securityfocus.com/archive/1/496297/100/0/threaded
More from Unreal Engine
–
CVE-2010-2702
Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal…