Bug 398161 – <games-simulation/openttd-1.2.0 Denial of Service (CVE-2012-{0048,0049})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sean Amoss (RETIRED) 2012-01-08 16:07:46 UTC]

From CVE request at $URL:

"The issue concerns a denial of service vulnerability in the form of a 
slow read attack preventing anyone to join the server, and preventing 
the continuation of a game when 'pause on join' is enabled. This attack 
requires the attacker to be authorized, but most servers do not 
implement authorization. The first vulnerable version is 0.3.5, the 
upcoming 1.1.5 release will have the issue fixed.

Once a CVE id is allocated, the issue and fix will be documented at
http://security.openttd.org/CVE-2012-xxxx"

[Comment 1 Sean Amoss (RETIRED) 2012-02-11 13:20:33 UTC]

@games: This is fixed in 1.1.5 released last month. Please provide an updated ebuild.

[Comment 2 Marian Kyral 2012-02-25 19:34:05 UTC]

Hi, I tested in https://bugs.gentoo.org/show_bug.cgi?id=396185 and only version bump of the ebuild and one patch file is needed. I also made a ebuild for 1.2_RC1

[Comment 3 Tomáš Chvátal (RETIRED) 2012-04-17 19:39:04 UTC]

1.2.0 added to main tree now by me.
@security:
Do your magic lads :)

[Comment 4 Sean Amoss (RETIRED) 2012-04-17 22:30:34 UTC]

Thanks, Tomáš.

Arches, please test and mark stable:
=games-simulation/openttd-1.2.0
Target KEYWORDS="amd64 ppc x86"

[Comment 5 Agostino Sarubbo 2012-04-18 19:52:33 UTC]

amd64 stable

[Comment 6 Tomáš Chvátal (RETIRED) 2012-04-18 20:34:39 UTC]

Adding opengfx to the list as it seems that with the old one it likes to crash.

=games-util/nml-0.2.3
=games-misc/opengfx-0.4.4
=games-simulation/openttd-1.2.0

Adding back amd64 as I had to prune the stabling due to breaking depgraph.

[Comment 7 Andreas Schürch 2012-04-19 11:06:52 UTC]

x86 stable, thanks

[Comment 8 Agostino Sarubbo 2012-04-19 11:54:02 UTC]

amd64 stable

[Comment 9 Markus Meier 2012-04-19 20:55:32 UTC]

arm passes

[Comment 10 Mark Loeser (RETIRED) 2012-05-06 19:30:19 UTC]

drop to ~ppc; ppc64 passes

[Comment 11 Tim Sammut (RETIRED) 2012-05-07 02:52:33 UTC]

Thanks, folks. GLSA Vote: no.

[Comment 12 Sean Amoss (RETIRED) 2012-05-07 22:29:47 UTC]

GLSA vote: no.

[Comment 13 GLSAMaker/CVETool Bot 2012-09-08 15:29:24 UTC]

CVE-2012-0048 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0048):
  OpenTTD 0.3.5 through 1.1.4 allows remote attackers to cause a denial of
  service (game pause) by connecting to the server and not finishing the (1)
  authorization phase or (2) map download, aka a "slow read" attack.