vendor:
Doom 3 Engine
by:
Luigi Auriemma
9
CVSS
CRITICAL
Format String Vulnerability
134
CWE
Product Name: Doom 3 Engine
Affected Version From: Doom 3 <= 1.3.1
Affected Version To: Doom 3 <= 1.3.1
Patch Exists: YES
Related CWE: CVE-2007-4840
CPE: a:id_software:doom_3:1.3.1
Metasploit:
https://www.rapid7.com/db/vulnerabilities/php-cve-2007-4840/, https://www.rapid7.com/db/vulnerabilities/php-fixed-iconv-functions-to-limit-argument-sizes-cve-2007-4840/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2007-4840/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2007-4840/
Platforms Tested: Windows, Linux, Mac
2007
Doom 3 Engine Format String Vulnerability
The Doom 3 engine is prone to a format-string vulnerability. Exploiting this issue will allow attackers to execute arbitrary code with the permissions of a user running the application. Failed attacks will likely cause denial-of-service conditions. Several games that use the Doom 3 engine are affected, including Doom 3, Quake 4, and Prey.
Mitigation:
Apply patches provided by the vendor to fix the format-string vulnerability. Disable the affected games until the patches can be applied.
