Epic Games Unreal Tournament Engine UMOD Manifest.INI Remote Arbitrary File Overwrite Vulnerability

Bugtraq ID:	10196
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 22 2004 12:00AM
Updated:	Apr 22 2004 12:00AM
Credit:	Disclosure of this issue is credited to Luigi Auriemma <[email protected]>.
Vulnerable:	Epic Games Unreal Tournament 3 1.3beta4 Epic Games Unreal Tournament 2003 2225 win32 Epic Games Unreal Tournament 2003 2225 macOS Epic Games Unreal Tournament 2003 2199 win32 Epic Games Unreal Tournament 2003 2199 macOS Epic Games Unreal Engine 436 + ARUSH Devastation 390.0 + ARUSH Devastation 381.0 + ARUSH Devastation 380.0 + Atari Magic The Gathering: Battlegrounds 1.4 + Atari Magic The Gathering: Battlegrounds 1.3 + Atari Magic The Gathering: Battlegrounds 1.2 + Atari Magic The Gathering: Battlegrounds 1.1 + Atari Magic The Gathering: Battlegrounds 1.0 + Atari Nerf Arena Blast + Eidos DeusEx 1.2 + Eidos DeusEx 1.1 + Eidos DeusEx 1.0 + Human Head Studios Rune 1.0.1 + Human Head Studios Rune 1.0 + Microprose Software Star Trek: Klingon Honor Guard + Microprose Software Tactical Ops 3.4 + Microprose Software Tactical Ops 3.3 + Microprose Software Tactical Ops 3.2 + Microprose Software Tactical Ops 3.1 + Microprose Software Tactical Ops 3.0 + Rage Software Mobile Forces + Running With Scissors Postal 2 + Ubi Rainbow Six: Raven Shield 1.5 + Ubi Rainbow Six: Raven Shield 1.4 + Ubi Rainbow Six: Raven Shield 1.3 + Ubi Rainbow Six: Raven Shield 1.2 + Ubi Rainbow Six: Raven Shield 1.1 + Ubi Rainbow Six: Raven Shield 1.0 + United States Department of Defense America's Army 2.0 .0 + United States Department of Defense America's Army: SFAS 2.0 .0a + United States Department of Defense America's Army: SFAS 1.9 .0 Epic Games Unreal Engine 3
Not Vulnerable:	Epic Games Unreal Tournament 2004 win32 Epic Games Unreal Tournament 2004 macOS

Epic Games Unreal Tournament Engine UMOD Manifest.INI Remote Arbitrary File Overwrite Vulnerability

Reportedly the Unreal Tournament Engine is affected by a local file overwrite vulnerability due to the UMOD manifest.ini file. This issue is due to an input validation error that allows a malicious user specify arbitrary files for writing, potentially leading to a system wide denial of service condition.

Epic Games Unreal Tournament Engine UMOD Manifest.INI Remote Arbitrary File Overwrite Vulnerability

No exploit is required to leverage this issue. The following proof of concept has been provided:

• /data/vulnerabilities/exploits/umodUnrealTournamentFileWritePOC.c

Epic Games Unreal Tournament Engine UMOD Manifest.INI Remote Arbitrary File Overwrite Vulnerability

Solution:
This issue has been resolved in the latest version of the game; Unreal Tournament 2004. Please contact the vendor for more information on obtaining the software.

Epic Games Unreal Tournament Engine UMOD Manifest.INI Remote Arbitrary File Overwrite Vulnerability

References:

• Unreal engine (Luigi Auriemma )
  
• Unreal Tournament Homepage (Epic Games)
  
• Arbitrary file overwriting in Unreal engine through UMOD (Luigi Auriemma )