« Volver al listado

CVE-2010-2702

Estado: ModificadaAlta (9.3)—

Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield, and SWAT4, when downloads are enabled, allows remote attackers to execute arbitrary code via a long LEVEL field in a WELCOME response to a download request.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Epicgames — Postal 2Epicgames — Raven ShieldEpicgames — Swat 4Epicgames — Unreal EngineEpicgames — Unreal Tournament 2003Epicgames — Unreal Tournament 2004

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-2702",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-07-12T17:30:03.187",
  "references": [
    {
      "url": "http://aluigi.altervista.org/adv/unrealcbof-adv.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://aluigi.org/poc/unrealcbof.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/66039",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/40466",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60142",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://aluigi.altervista.org/adv/unrealcbof-adv.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://aluigi.org/poc/unrealcbof.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/66039",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/40466",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60142",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in the UGameEngine::UpdateConnectingMessage function in the Unreal engine 1, 2, and 2.5, as used in multiple games including Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield, and SWAT4, when downloads are enabled, allows remote attackers to execute arbitrary code via a long LEVEL field in a WELCOME response to a download request."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de búfer en la función UGameEngine::UpdateConnectingMessage en el motor de Unreal v1, v2 y v2.5, tal como se utiliza en múltiples juegos, incluyendo Unreal Tournament 2004, Unreal tournament 2003, Postal 2, Raven Shield y SWAT4, cuando las descargas están permitidas, permite ejecutar código arbitrario a atacantes remotos a través de un campo LEVEL demasiado largo en una respuesta WELCOME a una solicitud de descarga."
    }
  ],
  "lastModified": "2026-06-16T23:21:21.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:epicgames:unreal_engine:1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09B8824F-CCAA-4756-BD0B-000CD162FAAE"
            },
            {
              "criteria": "cpe:2.3:a:epicgames:unreal_engine:2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DB76B1A-D2AF-4BC7-B3FB-F9C3D8B7077A"
            },
            {
              "criteria": "cpe:2.3:a:epicgames:unreal_engine:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C9F2B6F-7334-43F0-AE5E-70EDC79052A7"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:epicgames:postal_2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8DE3D5B-0A6C-4BD2-8AEF-DE4EFD93D137"
            },
            {
              "criteria": "cpe:2.3:a:epicgames:raven_shield:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4FC0308-0B20-467D-AB64-68F939E7785A"
            },
            {
              "criteria": "cpe:2.3:a:epicgames:swat_4:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2478849A-9FAB-45B3-A99B-07CCD1981A28"
            },
            {
              "criteria": "cpe:2.3:a:epicgames:unreal_tournament_2003:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62D13823-D9BD-427E-8CC5-8590D0C3037C"
            },
            {
              "criteria": "cpe:2.3:a:epicgames:unreal_tournament_2004:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6949154C-5F12-441D-8BAF-A096CE25DCCD"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}