Bug 844471 (CVE-2012-3436)

Summary:	CVE-2012-3436 OpenTTD: Denial of service (server) using ships on half tiles and landscaping
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anton, atorkhov, felix, matthijs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-05-03 10:33:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	844472
Bug Blocks:

Description Kurt Seifried 2012-07-30 19:07:00 UTC

OpenTTD developer Christoph 'frosch' Elsenhans reports:

Hello,

we, the OpenTTD developers, have identified a security
vulnerability in OpenTTD (an open source game with multiplayer).
Would you be so kind as to allocate a CVE id for this issue?

The issue concerns a denial of service vulnerabilty which enables 
an attacker to force the server into an invalid game state. The 
server will abort upon detecting this state. This attack can be
performed using an unmodified client via normal game interaction.
The attack requires authorization, but most servers do not
implement authorization. The first vulnerable version is 0.6.0, the
upcoming 1.2.2 release will have the issue fixed.

Once a CVE id is allocated, the issue and fix will be documented
at http://security.openttd.org/CVE-2012-3436

Thanks in advance, Christoph 'frosch' Elsenhans

(Please CC me, I'm not subscribed)

trunk commit: http://vcs.openttd.org/svn/changeset/24439/
Bug report: http://bugs.openttd.org/task/5254

http://security.openttd.org/en/CVE-2012-3436

Patch: http://security.openttd.org/en/patch/59.patch

Comment 1 Kurt Seifried 2012-07-30 19:07:48 UTC

Created openttd tracking bugs for this issue

Affects: fedora-all [bug 844472]

Comment 2 Matthijs Kooijman 2012-07-31 16:22:03 UTC

The detailed description is now public on
http://security.openttd.org/CVE-2012-3436

Note that both the problem description and patches have been updated
to cover a second case of this bug, so if you downloaded the patches
before 2012-07-31 16:00 UTC, please download them again.

Comment 3 Fedora Update System 2012-08-27 03:25:08 UTC

openttd-1.2.2-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2012-08-27 03:28:05 UTC

openttd-1.2.2-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2012-09-17 23:43:58 UTC

openttd-1.2.2-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.