CVE-2007-5247

First Encounter Assault Recon < 1.08 - Remote Code Execution via Format String in PB_Y or PB_U Packets

Title source: llm
STIX 2.1

Description

Multiple format string vulnerabilities in the Monolith Lithtech engine, as used by First Encounter Assault Recon (F.E.A.R.) 1.08 and earlier, when Punkbuster (PB) is enabled, allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in (1) a PB_Y packet to the YPG server on UDP port 27888 or (2) a PB_U packet to UCON on UDP port 27888, different vectors than CVE-2004-1500. NOTE: this issue might be in Punkbuster itself, but there are insufficient details to be certain.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/45530
Exploit x_refsource_misc
http://aluigi.org/poc/fearfspb.zip
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/481231/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3197
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/45531
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/36900

Scores

EPSS 0.0516
EPSS Percentile 91.3%

Details

CWE
CWE-134
Status published
Products (1)
monolith_productions/first_encounter_assault_recon < 1.08
Published Oct 06, 2007
Tracked Since Feb 18, 2026