125304 2006-03-06 15:20 0000 <=games-strategy/freeciv-2.0.7 - remotely triggered oom condition 2006-03-16 02:15:10 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED B3 [glsa] DerCorny P2 minor --- 1 carlo@gentoo.org security@gentoo.org games@gentoo.org carlo@gentoo.org 2006-03-06 15:20:17 0000 Freeciv supports both plain and compressed data (admins can disable this feature only recompiling the server from the source code with USE_COMPRESSION undefined). When the server receives a jumbo data (size set to 0xffff) it reads the subsequent 32 bits number which identifies the size of the compressed data. Then it makes a signed comparison to know if the compressed size is major than the data received, if the client uses a negative compressed size value it will be able to elude this check. After having substracted 6 bytes (header size) from this number the server tries to allocate the memory needed for decompressing the data which is fixed to 100 times this size. If the memory cannot be allocated the server terminates or freezes showing an out of memory message. http://aluigi.altervista.org/adv/freecivdos-adv.txt dercorny@gentoo.org 2006-03-06 15:26:00 0000 arches please test and mark stable, thank you. weeve@gentoo.org 2006-03-06 19:56:47 0000 I'm assuming you mean 2.0.8 here, but please use exact versions in the future to avoid any confusion. mr_bones_@gentoo.org 2006-03-06 21:41:00 0000 x86 is stable. gustavoz@gentoo.org 2006-03-07 09:06:18 0000 sparcenstein! koon@gentoo.org 2006-03-07 13:31:28 0000 Removing x86 which is already marked stable josejx@gentoo.org 2006-03-07 19:04:46 0000 Marked ppc stable by Pylon, tested by mabi. dercorny@gentoo.org 2006-03-08 00:37:45 0000 removing ppc from CC because of comment #6 yoswink@gentoo.org 2006-03-09 03:42:56 0000 alpha is always ready for fun! eer ... alpha stable. blubb@gentoo.org 2006-03-12 07:53:30 0000 amd64 stable, sorry for the delay dercorny@gentoo.org 2006-03-12 07:57:33 0000 No RCE, no critical service - tend to say no here mr_bones_@gentoo.org 2006-03-12 09:13:44 0000 2.0.7 has been removed from portage. koon@gentoo.org 2006-03-12 10:49:18 0000 Bad players can kill the game server, I tend to vote yes, so we'll need one more opinion :) We usually don't issue GLSAs for game servers DoS though. dercorny@gentoo.org 2006-03-12 12:15:23 0000 Ah well, you know what: i happened to have some spare time to draft and you are the leader, so i'll follow you - let's have a glsa. dercorny@gentoo.org 2006-03-16 02:15:10 0000 GLSA 200603-11 Thanks everybody.