CVE-2004-0608

Public Exploit

Description

The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier, Rune 107 and earlier, Tactical Ops 3.4.0 and earlier, Unreal 1 226f and earlier, Unreal II XMP 7710 and earlier, Unreal Tournament 451b and earlier, Unreal Tournament 2003 2225 and earlier, Unreal Tournament 2004 before 3236, Wheel of Time 333b and earlier, and X-com Enforcer, allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value, which overwrites memory.

10.0

CVSS

Severity: Critical

CVSS 2.0 •

EPSS 60.18% Top 5%

Vendor Advisory gentoo.org Vendor Advisory altervista.org Vendor Advisory securityfocus.com

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/10570	exploit vdb entry vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200407-14.xml	patch vendor advisory
http://marc.info/?l=bugtraq&m=108787105023304&w=2	mailing list
http://aluigi.altervista.org/adv/unsecure-adv.txt	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16451	vdb entry

Frequently Asked Questions

What is the severity of CVE-2004-0608?: CVE-2004-0608 has been scored as a critical severity vulnerability.
How to fix CVE-2004-0608?: To fix CVE-2004-0608, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2004-0608 being actively exploited in the wild?: It is possible that CVE-2004-0608 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~60% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.