OpenTTD developer Christoph 'frosch' Elsenhans reports: Hello, we, the OpenTTD developers, have identified a security vulnerability in OpenTTD (an open source game with multiplayer). Would you be so kind as to allocate a CVE id for this issue? The issue concerns a denial of service vulnerabilty which enables an attacker to force the server into an invalid game state. The server will abort upon detecting this state. This attack can be performed using an unmodified client via normal game interaction. The attack requires authorization, but most servers do not implement authorization. The first vulnerable version is 0.6.0, the upcoming 1.2.2 release will have the issue fixed. Once a CVE id is allocated, the issue and fix will be documented at http://security.openttd.org/CVE-2012-3436 Thanks in advance, Christoph 'frosch' Elsenhans (Please CC me, I'm not subscribed) trunk commit: http://vcs.openttd.org/svn/changeset/24439/ Bug report: http://bugs.openttd.org/task/5254 http://security.openttd.org/en/CVE-2012-3436 Patch: http://security.openttd.org/en/patch/59.patch
Created openttd tracking bugs for this issue Affects: fedora-all [bug 844472]
The detailed description is now public on http://security.openttd.org/CVE-2012-3436 Note that both the problem description and patches have been updated to cover a second case of this bug, so if you downloaded the patches before 2012-07-31 16:00 UTC, please download them again.
openttd-1.2.2-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
openttd-1.2.2-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
openttd-1.2.2-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.