Description
Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) the LEVEL parameter in a WELCOME command.
References
- 48291 vdb-entry
- 20080911 Clients format strings in the Unreal engine mailing-list
- 31141 vdb-entry
- 20080911 Clients format strings in the Unreal engine mailing-list
- 48290 vdb-entry
- 31854 third-party-advisory
- http://aluigi.altervista.org/adv/unrealcfs-adv.txt
- unrealengine-dlmgr-format-string(45088) vdb-entry
- unrealengine-pkg-format-string(45089) vdb-entry
- unrealengine-welcome-format-string(45090) vdb-entry