CVE-2008-6441 : Format string vulnerability in the Epic Games Unreal engine client, as used in m

Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) the LEVEL parameter in a WELCOME command.

Published 2009-03-09 14:30:00

Updated 2018-10-11 20:57:14

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2008-6441

Epicgames » Unreal Engine » Version: 2
cpe:2.3:a:epicgames:unreal_engine:2:*:*:*:*:*:*:*
Matching versions
Epicgames » Unreal Engine » Version: 2.5
cpe:2.3:a:epicgames:unreal_engine:2.5:*:*:*:*:*:*:*
Matching versions
Epicgames » Unreal Engine » Version: 3
cpe:2.3:a:epicgames:unreal_engine:3:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2008-6441

EPSS FAQ

0.65%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 79 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-6441

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2008-6441

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-6441

Jump to

Vulnerability Details : CVE-2008-6441

Products affected by CVE-2008-6441

Exploit prediction scoring system (EPSS) score for CVE-2008-6441

CVSS scores for CVE-2008-6441

CWE ids for CVE-2008-6441

References for CVE-2008-6441