PT-2012-2265 · Openttd · Openttd

Xor · Published 2012-08-25 · Updated 2012-08-27 · CVE-2012-0048

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenTTD versions 0.3.5 through 1.1.4

Description The issue allows remote attackers to cause a denial of service, resulting in a game pause, by connecting to the server and not completing either the authorization phase or the map download, which is referred to as a "slow read" attack.

Recommendations For OpenTTD versions 0.3.5 through 1.1.4, consider implementing measures to detect and prevent slow read attacks, such as timing out incomplete connections or limiting the number of concurrent connections to prevent denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2012-0048

Affected Products

Openttd

References · 9

• 🔥 http://vcs.openttd.org/svn/changeset/23764 · Exploit
• http://secunia.com/advisories/50137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0048 · Security Note
• http://debian.org/security/2012/dsa-2524 · Vendor Advisory
• http://security.openttd.org/en/CVE-2012-0049 · Vendor Advisory
• http://bugs.openttd.org/task/4955 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/01/13/8 · Note
• http://tt-forums.net/viewtopic.php?f=33&t=58073&hilit=pause#p989303 · Note
• http://openwall.com/lists/oss-security/2012/01/07/2 · Note