oss-security - CVE request for OpenTTD

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 27 Jul 2012 23:42:39 +0200
From: frosch <frosch@...nttd.org>
To: oss-security@...ts.openwall.com
Subject: CVE request for OpenTTD

Hello,

we, the OpenTTD developers, have identified a security vulnerability in
OpenTTD (an open source game with multiplayer). Would you be so kind as 
to allocate a CVE id for this issue?

The issue concerns a denial of service vulnerabilty which enables
an attacker to force the server into an invalid game state. The
server will abort upon detecting this state.
This attack can be performed using an unmodified client via normal
game interaction. The attack requires authorization, but most servers
do not implement authorization. The first vulnerable version is 0.6.0,
the upcoming 1.2.2 release will have the issue fixed.

Once a CVE id is allocated, the issue and fix will be documented at
http://security.openttd.org/CVE-2012-xxxx

Thanks in advance,
Christoph 'frosch' Elsenhans

(Please CC me, I'm not subscribed)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.