Red Hat Bugzilla – Bug 616874
CVE-2010-2534 OpenTTD: DoS (server infinite loop with excessive CPU use) when new client is joining server game (FS#3909)
Last modified: 2016-03-04 07:15:25 EST
User with nickname 'Dolly' reported:
a deficiency in the way OpenTTD transportation business simulation game
server synced local command queue to the command queue of the given socket
after receiving a command from a game joining client. A remote attacker
could use this flaw to conduct denial of service attacks, leading to game
server infinite loop consuming excessive amount of CPU time.
 http://bugs.openttd.org/task/3909/getfile/6237/loop_fix.patch (needs
upstream review and may change in final form)
How reproducible: Sometimes
This issue affects the versions of the openttd package, as shipped
with Fedora release of 12 and 13. Please fix once final version of
upstream patch is known.
Created openttd tracking bugs for this issue
Affects: fedora-all [bug 616875]
The CVE identifier of CVE-2010-2534 has been assigned to this issue
openttd-1.0.3-0.1.RC1.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
openttd-1.0.3-0.1.RC1.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.