PT-2012-2265 · Openttd · Openttd

Xor · Publicado 2012-08-25 · Atualizado 2012-08-27 · CVE-2012-0048

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenTTD versions 0.3.5 through 1.1.4

Description The issue allows remote attackers to cause a denial of service, resulting in a game pause, by connecting to the server and not completing either the authorization phase or the map download, which is referred to as a "slow read" attack.

Recommendations For OpenTTD versions 0.3.5 through 1.1.4, consider implementing measures to detect and prevent slow read attacks, such as timing out incomplete connections or limiting the number of concurrent connections to prevent denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2012-0048

Produtos afetados

Openttd

Referências · 9

• 🔥 http://vcs.openttd.org/svn/changeset/23764 · Exploit
• http://secunia.com/advisories/50137 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-0048 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/01/13/8 · Nota
• http://tt-forums.net/viewtopic.php?f=33&t=58073&hilit=pause#p989303 · Nota
• http://debian.org/security/2012/dsa-2524 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/01/07/2 · Nota
• http://security.openttd.org/en/CVE-2012-0049 · Aviso do Fabricante
• http://bugs.openttd.org/task/4955 · Aviso do Fabricante