|
OpenTTD Error Number Handling Denial of Service
|
|
Secunia Advisory:
|
SA19768
|
|
|
Release Date:
|
2006-04-24
|
|
Last Update:
|
2006-04-26
|
|
Popularity:
|
5,232 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | OpenTTD 0.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-1998
CVE-2006-1999
|
|
Description:
Luigi Auriemma has reported a vulnerability in OpenTTD, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error within the handling of error numbers received in PACKET_SERVER_ERROR and PACKET_CLIENT_ERROR command packets. This can be exploited to cause the server to terminate via an invalid error number sent by a malicious client.
Successful exploitation requires that the attacker has not been banned from the server.
Note: It has also been reported that an error exists in the client within the handling of the packet size field in a received UDP. This can cause the client to return immediately to the main menu via replies sent from a malicious server.
The vulnerability has been reported in version 0.4.7. Prior versions may also be affected.
Solution:
The vulnerability has reportedly been fixed in revision r4531 in the CVS repositories.
Provided and/or discovered by:
Luigi Auriemma
Changelog:
2006-04-26: Added CVE references.
Original Advisory:
http://aluigi.altervista.org/adv/openttdx-adv.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
