Epic Games Unreal Engine Memory Corruption Vulnerability

Bugtraq ID:	10570
Class:	Boundary Condition Error
CVE:	CVE-2004-0608
Remote:	Yes
Local:	No
Published:	Jun 18 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	Discovery is credited to Luigi Auriemma <[email protected]>.
Vulnerable:	Running With Scissors Postal 2 1337 Robert Jordan Wheel of Time 333.0 b Rage Software Mobile Forces 20000.0 Nerf Arena Blast Nerf Arena Blast 1.2 Ion Storm DeusEx 1.112 fm Infogrames X-com Enforcer Infogrames TacticalOps 3.4 Gentoo Linux 1.4 Epic Games Unreal Tournament 3 1.3beta4 Epic Games Unreal Tournament 2004 win32 Epic Games Unreal Tournament 2004 macOS Epic Games Unreal Tournament 2003 2225 win32 Epic Games Unreal Tournament 2003 2225 macOS Epic Games Unreal Tournament 2003 2199 win32 Epic Games Unreal Tournament 2003 2199 macOS Epic Games Unreal Tournament 2003 2199 linux Epic Games Unreal Engine 436 + ARUSH Devastation 390.0 + ARUSH Devastation 381.0 + ARUSH Devastation 380.0 + Atari Magic The Gathering: Battlegrounds 1.4 + Atari Magic The Gathering: Battlegrounds 1.3 + Atari Magic The Gathering: Battlegrounds 1.2 + Atari Magic The Gathering: Battlegrounds 1.1 + Atari Magic The Gathering: Battlegrounds 1.0 + Atari Nerf Arena Blast + Eidos DeusEx 1.2 + Eidos DeusEx 1.1 + Eidos DeusEx 1.0 + Human Head Studios Rune 1.0.1 + Human Head Studios Rune 1.0 + Microprose Software Star Trek: Klingon Honor Guard + Microprose Software Tactical Ops 3.4 + Microprose Software Tactical Ops 3.3 + Microprose Software Tactical Ops 3.2 + Microprose Software Tactical Ops 3.1 + Microprose Software Tactical Ops 3.0 + Rage Software Mobile Forces + Running With Scissors Postal 2 + Ubi Rainbow Six: Raven Shield 1.5 + Ubi Rainbow Six: Raven Shield 1.4 + Ubi Rainbow Six: Raven Shield 1.3 + Ubi Rainbow Six: Raven Shield 1.2 + Ubi Rainbow Six: Raven Shield 1.1 + Ubi Rainbow Six: Raven Shield 1.0 + United States Department of Defense America's Army 2.0 .0 + United States Department of Defense America's Army: SFAS 2.0 .0a + United States Department of Defense America's Army: SFAS 1.9 .0 Epic Games Unreal Engine 3 Epic Games Unreal Engine 226f DreamForge TNN Outdoors Pro Hunter ARUSH Devastation 390.0
Not Vulnerable:	United States Department of Defense America's Army: SFAS 2.0 .0a United States Department of Defense America's Army: SFAS 1.9 .0 United States Department of Defense America's Army 2.0 .0 Ubi XIII Ubi Splinter Cell Pandora Tomorrow Ubi Rainbow Six: Raven Shield 1.5 Ubi Rainbow Six: Raven Shield 1.4 Ubi Rainbow Six: Raven Shield 1.3 Ubi Rainbow Six: Raven Shield 1.2 Ubi Rainbow Six: Raven Shield 1.1 Ubi Rainbow Six: Raven Shield 1.0 Microprose Software Star Trek: Klingon Honor Guard Human Head Studios Dead Man's Hand Epic Games Unreal Tournament 2004 3236 Atari Magic The Gathering: Battlegrounds 1.4 Atari Magic The Gathering: Battlegrounds 1.3 Atari Magic The Gathering: Battlegrounds 1.2 Atari Magic The Gathering: Battlegrounds 1.1 Atari Magic The Gathering: Battlegrounds 1.0

Epic Games Unreal Engine Memory Corruption Vulnerability

Unreal Engine is reportedly prone to a memory corruption vulnerability. This issue presents itself when a remote attacker sends an excessive value to a vulnerable game server through a '\secure\' query.

An attacker can exploit this issue to potentially overwrite sensitive memory addresses leading to a variety of attacks including denial of service and possible remote code execution.

Epic Games Unreal Engine Memory Corruption Vulnerability

A proof of concept is available at the following location:
http://aluigi.altervista.org/poc/unsecure.zip

An Exploit has been released for this issue as part of the Metasploit Framework project version 2.2. Various other exploits have been released as well. Please see the Metasploit exploits site in Web references for more information.

Exploit code for the Linux platform is available as well.

• /data/vulnerabilities/exploits/ut2004_secure_win32.pm
• /data/vulnerabilities/exploits/ut2004_secure_linux.pm

Epic Games Unreal Engine Memory Corruption Vulnerability

Solution:
It is reported that Patch 3236 addresses this problem in Unreal Tournament 2004.

Gentoo Linux has released advisory GLSA 200407-14 addressing this issue. Please see the referenced advisory for further information. Users of affected packages are urged to execute the following command as the superuser:
emerge sync

Then, depending on the package(s) currently installed, execute the appropriate following commands as superuser:
emerge -pv ">=games-fps/ut2003-2225-r3"
emerge ">=games-fps/ut2003-2225-r3"
emerge -pv ">=games-server/ut2003-ded-2225-r2"
emerge ">=games-server/ut2003-ded-2225-r2"
emerge -pv ">=games-fps/ut2004-3236"
emerge ">=games-fps/ut2004-3236"
emerge -pv ">=games-fps/ut2004-demo-3120-r4"
emerge ">=games-fps/ut2004-demo-3120-r4"

Currently we are not aware of any other vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.


Epic Games Unreal Tournament 2004 macOS

• Epic Games Patch 3236
  http://www.atari-webcenter.com/friends/?module=friends&action=viewDown loadPage&id=120

Epic Games Unreal Tournament 2004 win32

• Epic Games Patch 3236
  http://www.atari-webcenter.com/friends/?module=friends&action=viewDown loadPage&id=120

Epic Games Unreal Engine Memory Corruption Vulnerability

References:

• Home Page (Epic Games)
  
• Metasploit Framework Exploits (Metasploit)
  
• Unreal Tournament Homepage (Epic Games)
  
• Code execution in the Unreal Engine through \secure\ packe (Luigi Auriemma )
  
• Solution for bugtraq id 10570 (Epic Games Unreal Engine Memory Corruption Vulner ("Gerco Dries" )