[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1343472812.6401.20.camel@lagune.teich>
Date: Sat, 28 Jul 2012 12:53:32 +0200
From: frosch <frosch@...nttd.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request for OpenTTD
> On 07/27/2012 03:42 PM, frosch wrote:
> > Hello,
> >
> > we, the OpenTTD developers, have identified a security
> > vulnerability in OpenTTD (an open source game with multiplayer).
> > Would you be so kind as to allocate a CVE id for this issue?
> >
> > The issue concerns a denial of service vulnerabilty which enables
> > an attacker to force the server into an invalid game state. The
> > server will abort upon detecting this state. This attack can be
> > performed using an unmodified client via normal game interaction.
> > The attack requires authorization, but most servers do not
> > implement authorization. The first vulnerable version is 0.6.0, the
> > upcoming 1.2.2 release will have the issue fixed.
> >
> > Once a CVE id is allocated, the issue and fix will be documented
> > at http://security.openttd.org/CVE-2012-xxxx
> >
> > Thanks in advance, Christoph 'frosch' Elsenhans
> >
> > (Please CC me, I'm not subscribed)
>
> Sorry can you please provide links to an advisory, code commit, or
> something so we have a reference?
>
trunk commit: http://vcs.openttd.org/svn/changeset/24439/
Bug report: http://bugs.openttd.org/task/5254
Later on http://security.openttd.org/CVE-2012-xxxx will supply patches
for all vulnerable versions, and also link to the bug tracker and
related commits.
Regards
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
