Secunia

Some vulnerabilities have been reported in OpenTTD, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

1) Some format string error in the handling of network text messages in network_server.c, network.c, console_cmds.c, and network_client.c can be exploited to crash the OpenTTD server or client and potentially to execute arbitrary code.

2) Some boundary errors due to the unsafe use of "vsprintf()" may be exploited to cause a DoS and potentially to execute arbitrary code.

Vulnerabilities #1 and #2 have been reported in version 0.4.0.1. Other versions may also be affected.

3) An input validation error exists in the "CmdPlantTree()" function in tree_cmd.c when handling the tree-planting command. This may be exploited to cause a buffer overflow.

Solution
Update to version 0.4.5.
Further details available in Customer Area

Provided and/or discovered by
1-2) Alexey Dobriyan
3) Reported by vendor

Changelog
Further details available in Customer Area

Original Advisory
http://www.tt-forums.net/viewtopic.php?p=400836
http://svn.openttd.org/cgi-bin/trac.cgi/changeset/2899
http://svn.openttd.org/cgi-bin/trac.cgi/changeset/3446

Deep Links
Links available in Customer Area