Bug 772791

Summary:	OpenTTD slow read attack
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	atorkhov, felix
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-31 08:37:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	773450
Bug Blocks:

Description Kurt Seifried 2012-01-10 00:14:50 UTC

http://seclists.org/oss-sec/2012/q1/84

Hi folks,

we, the OpenTTD developers, have identified a security vulnerability in
OpenTTD (an open source game with multiplayer). Would you be so kind as to allocate a CVE id for this issue?

The issue concerns a denial of service vulnerability in the form of a slow read attack preventing anyone to join the server, and preventing the continuation of a game when 'pause on join' is enabled. This attack requires the attacker to be authorized, but most servers do not implement authorization. The first vulnerable version is 0.3.5, the upcoming 1.1.5 release will have the issue fixed.

Once a CVE id is allocated, the issue and fix will be documented at
http://security.openttd.org/CVE-2012-xxxx

Thanks in advance,
Remko 'Rubidium' Bijker

(Please CC me, I'm not subscribed)

Comment 1 Kurt Seifried 2012-01-11 21:04:59 UTC

Created openttd tracking bugs for this issue

Affects: fedora-all [bug 773450]

Comment 2 Fedora Update System 2012-01-28 03:24:17 UTC

openttd-1.1.5-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2012-01-28 03:26:05 UTC

openttd-1.1.5-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.