Date: Sat, 28 Jul 2012 12:53:32 +0200 From: frosch <frosch@...nttd.org> To: Kurt Seifried <kseifried@...hat.com> Cc: oss-security@...ts.openwall.com Subject: Re: CVE request for OpenTTD > On 07/27/2012 03:42 PM, frosch wrote: > > Hello, > > > > we, the OpenTTD developers, have identified a security > > vulnerability in OpenTTD (an open source game with multiplayer). > > Would you be so kind as to allocate a CVE id for this issue? > > > > The issue concerns a denial of service vulnerabilty which enables > > an attacker to force the server into an invalid game state. The > > server will abort upon detecting this state. This attack can be > > performed using an unmodified client via normal game interaction. > > The attack requires authorization, but most servers do not > > implement authorization. The first vulnerable version is 0.6.0, the > > upcoming 1.2.2 release will have the issue fixed. > > > > Once a CVE id is allocated, the issue and fix will be documented > > at http://security.openttd.org/CVE-2012-xxxx > > > > Thanks in advance, Christoph 'frosch' Elsenhans > > > > (Please CC me, I'm not subscribed) > > Sorry can you please provide links to an advisory, code commit, or > something so we have a reference? > trunk commit: http://vcs.openttd.org/svn/changeset/24439/ Bug report: http://bugs.openttd.org/task/5254 Later on http://security.openttd.org/CVE-2012-xxxx will supply patches for all vulnerable versions, and also link to the bug tracker and related commits. Regards
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.