Date: Fri, 27 Jul 2012 23:42:39 +0200 From: frosch <frosch@...nttd.org> To: oss-security@...ts.openwall.com Subject: CVE request for OpenTTD Hello, we, the OpenTTD developers, have identified a security vulnerability in OpenTTD (an open source game with multiplayer). Would you be so kind as to allocate a CVE id for this issue? The issue concerns a denial of service vulnerabilty which enables an attacker to force the server into an invalid game state. The server will abort upon detecting this state. This attack can be performed using an unmodified client via normal game interaction. The attack requires authorization, but most servers do not implement authorization. The first vulnerable version is 0.6.0, the upcoming 1.2.2 release will have the issue fixed. Once a CVE id is allocated, the issue and fix will be documented at http://security.openttd.org/CVE-2012-xxxx Thanks in advance, Christoph 'frosch' Elsenhans (Please CC me, I'm not subscribed)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ