Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 233929 (CVE-2008-3547)

Summary: games-simulation/openttd <0.6.3 TruncateString() Buffer Overflow (CVE-2008-{3547,3576,3577})
Product: Gentoo Security Reporter: Robert Buchholz (RETIRED) <rbu>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: bugzie, esigra, games, gentoo, heiko.rosemann, robbat2, truebrain
Priority: High Keywords: STABLEREQ
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://secunia.com/advisories/31350/
Whiteboard: B2/B1? [glsa]
Package list:
Runtime testing required: ---
Bug Depends on: 215776    
Bug Blocks:    
Attachments:
Description Flags
openttd-0.6.2-truncate-string.patch
none
backported fix for 0.5.x none

Description Robert Buchholz (RETIRED) gentoo-dev 2008-08-05 01:28:09 UTC
Secunia writes:
A vulnerability has been reported in OpenTTD, which potentially can
be exploited by malicious people to cause a DoS (Denial of Service)
or to compromise a vulnerable system.

The vulnerability is caused due to a boundary error within the
"TruncateString()" function in src/gfx.cpp. This can be exploited to
potentially cause a buffer overflow via a specially crafted string.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in versions prior to 0.6.2.

SOLUTION:
Update to version 0.6.2.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://sourceforge.net/project/shownotes.php?release_id=617243
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2008-08-05 01:35:05 UTC
Created attachment 162239 [details, diff]
openttd-0.6.2-truncate-string.patch

Just for reference, the patch in question. It also affects 0.5.3 as it is in our tree, a backport should be trivial if the ebuild cannot be bumped to 0.6.
Comment 2 Mr. Bones. (RETIRED) gentoo-dev 2008-08-05 01:47:18 UTC
masked games-simulation/openttd until it's fixed.
Comment 3 corec 2008-08-05 05:30:30 UTC
Created attachment 162242 [details, diff]
backported fix for 0.5.x

This is the backported patch of openttd-0.6.2-truncate-string.patch. Compiled fine with me and game playes without problems. This patch also works just fine with 0.5.3 because gfx.c files are identical in 0.5.2 and 0.5.3.
Comment 4 Robert Buchholz (RETIRED) gentoo-dev 2008-08-05 10:36:02 UTC
This might not be the only buffer overflow fixed in 0.6.2, see
http://thread.gmane.org/gmane.comp.security.oss.general/766
Comment 5 Robert Buchholz (RETIRED) gentoo-dev 2008-08-06 11:53:23 UTC
As Nico pointed out in the URL above, further patches would need backporting. Is bumping to 0.6.2 an option for us?
Comment 6 Robert Buchholz (RETIRED) gentoo-dev 2008-08-08 12:40:09 UTC
CVE-2008-3547 for the Debian issue
Comment 7 Robert Buchholz (RETIRED) gentoo-dev 2008-08-15 13:06:32 UTC
CVE-2008-3576 for the TruncateString()

Games, any news here?
Comment 8 Robert Buchholz (RETIRED) gentoo-dev 2008-08-15 13:09:01 UTC
CVE-2008-3577:
         Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows
         local users to execute arbitrary code via a large filename supplied to
         the "-g" parameter in the ttd_main function.  NOTE: it is unlikely
         that this issue would cross privilege boundaries in typical
         environments.
Comment 9 Mr. Bones. (RETIRED) gentoo-dev 2008-08-15 17:35:42 UTC
It's masked.  We'll fix it when we fix it.
Comment 10 Patric Stout 2008-10-16 12:32:26 UTC
Would it be possible to change the hard mask to only versions before 0.6.3? 0.6.3 fixes all CVEs. As OpenTTD now wants to push out an overlay with ebuilds, the hard mask is holding it back (and I can't find a way to override the hard mask from within an overlay). Thank you in advance.
Comment 11 Christian Hoffmann (RETIRED) gentoo-dev 2008-10-19 10:10:51 UTC
(In reply to comment #10)
> Would it be possible to change the hard mask to only versions before 0.6.3?
> 0.6.3 fixes all CVEs. As OpenTTD now wants to push out an overlay with ebuilds,
> the hard mask is holding it back (and I can't find a way to override the hard
> mask from within an overlay). Thank you in advance.
A file named package.unmask in profiles/ should work, I guess, so no need to change the masks in our official tree.

games, you should probably bump and unmask, once you've got time.

Comment 12 Patric Stout 2008-10-19 11:29:33 UTC
(In reply to comment #11)
> A file named package.unmask in profiles/ should work, I guess, so no need to
> change the masks in our official tree.
> 
> games, you should probably bump and unmask, once you've got time.
> 

Exactly my thoughts ... but I couldn't get it to work. Then of course there is a good possibility I am doing something wrong.

# cat profiles/package.unmask
games-simulation/openttd

# emerge -av openttd
(still fails)

(same for '=games-simulation/openttd-0.6.3' and '<=games-simulation/openttd-0.6.2') ..

But okay, I will just wait for someone to official add 0.6.3 in the portage. Tnx for your reply!
Comment 13 Tupone Alfredo gentoo-dev 2008-11-10 20:41:16 UTC
Version 0.6.3 is in portage now and unmasked. Can be closed?
Comment 14 Christian Hoffmann (RETIRED) gentoo-dev 2008-11-10 20:58:52 UTC
(In reply to comment #13)
> Version 0.6.3 is in portage now and unmasked. Can be closed?
Nah, we need this stable first. 0.6.3 ready to go stable?
Comment 15 Tupone Alfredo gentoo-dev 2008-11-27 19:45:13 UTC
(In reply to comment #14)
> 0.6.3 ready to go stable?
As it use EAPI=2 we should wait for portage to stabilize

Comment 16 Patric Stout 2008-11-27 19:46:55 UTC
But why is it using EAPI=2 in the first place? It is not like it uses any of the new features ...
Comment 17 Robert Buchholz (RETIRED) gentoo-dev 2008-11-27 19:52:39 UTC
(In reply to comment #16)
> But why is it using EAPI=2 in the first place? It is not like it uses any of
> the new features ...

The ebuild does, it has USE deps and src_configure. We can either wait this out until portage with EAPI=2 is stable, or create an -r1 that reintroduces built_with_use moves the src_configure code.
Comment 18 Patric Stout 2008-11-27 19:57:01 UTC
Ah, sorry, you are right. I am trying to get the following ebuild in the official portage for ages now .. I seem to fail to do so ;)

http://packages.openttd.org/gentoo/overlay/games-simulation/openttd/openttd-0.6.3.ebuild

It uses EAPI=1, and is what we as OpenTTD publish as official ebuilds at the moment (as at least the general public can use it ...)
Comment 19 Mathias Habl├╝tzel 2009-01-01 15:18:58 UTC
Regarding the status on the openttd website would it be possible to stabilize the ebuild? The last post has been commited on th 27th of November ...
Comment 20 Robert Buchholz (RETIRED) gentoo-dev 2009-01-02 14:03:21 UTC
EAPI-2 portage is now stable, is 0.6.3 good to go now?
Comment 21 Robert Buchholz (RETIRED) gentoo-dev 2009-01-13 17:06:37 UTC
Robin, do you approve of this going stable?
Comment 22 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2009-01-13 20:47:11 UTC
rbu: +1 from me.
Comment 23 Robert Buchholz (RETIRED) gentoo-dev 2009-01-13 21:02:58 UTC
Arches, please test and mark stable:
=games-simulation/openttd-0.6.3
Target keywords : "amd64 ppc ppc64 x86"
Comment 24 Markus Meier gentoo-dev 2009-01-15 21:56:28 UTC
tests fail on amd64/x86:
>>> Test phase [check]: games-simulation/openttd-0.6.3
make -j2 -j1 check 
make[1]: Entering directory `/var/tmp/portage/games-simulation/openttd-0.6.3/work/openttd-0.6.3/objs/release'
[SRC] No such source-file: check.[c|cpp|mm|rc]
make[1]: Leaving directory `/var/tmp/portage/games-simulation/openttd-0.6.3/work/openttd-0.6.3/objs/release'
cc -Wl,-O1  check.o   -o check
gcc: check.o: No such file or directory
make: *** [check] Error 1
 * 
 * ERROR: games-simulation/openttd-0.6.3 failed.
 * Call stack:
 *               ebuild.sh, line   49:  Called src_test
 *             environment, line 2583:  Called _eapi0_src_test
 *               ebuild.sh, line  602:  Called die
 * The specific snippet of code:
 *   			hasq test $FEATURES && die "Make check failed. See above for details."
 *  The die message:
 *   Make check failed. See above for details.

games-simulation/openttd-0.6.3  USE="alsa iconv png truetype zlib -debug -dedicated -scenarios -timidity"

Portage 2.1.6.4 (default/linux/x86/2008.0/desktop, gcc-4.1.2, glibc-2.6.1-r0, 2.6.28 i686)
=================================================================
System uname: Linux-2.6.28-i686-Intel-R-_Core-TM-2_Duo_CPU_T8300_@_2.40GHz-with-glibc2.0
Timestamp of tree: Thu, 15 Jan 2009 20:30:01 +0000
app-shells/bash:     3.2_p39
dev-java/java-config: 1.3.7-r1, 2.1.6-r1
dev-lang/python:     2.4.4-r14, 2.5.2-r7
dev-python/pycrypto: 2.0.1-r6
dev-util/cmake:      2.4.6-r1
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.63
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.27-r2
ACCEPT_KEYWORDS="x86"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686 -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /opt/openfire/resources/security/ /opt/openjms/config /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/lib/fax /usr/share/config /var/bind /var/lib/hsqldb /var/qmail/alias /var/qmail/control /var/spool/fax/etc /var/spool/torque"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -march=i686 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="collision-protect distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict test unmerge-orphans userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LDFLAGS="-Wl,-O1"
LINGUAS="en en_GB de"
MAKEOPTS="-j2"
PKGDIR="/mnt/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X acl acpi alsa apache2 avahi berkdb bluetooth branding bzip2 cairo cdr cli cracklib crypt cups dbus dri dvd dvdr dvdread eds emboss encode esd evo examples fam firefox fortran gdbm gif gnome gpm gstreamer gtk hal iconv ipv6 isdnlog jpeg kde ldap libnotify mad midi mikmod mp3 mpeg mudflap ncurses nls nptl nptlonly ogg opengl openmp pam pcre pdf perl png ppds pppd python qt3 qt3support qt4 quicktime readline reflection sdl session source spell spl ssl startup-notification svg sysfs tcpd test tiff truetype unicode usb vorbis win32codecs x86 xml xorg xulrunner xv zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en en_GB de" USERLAND="GNU" VIDEO_CARDS="fbdev glint i810 intel mach64 mga neomagic nv r128 radeon savage sis tdfx trident vesa vga via vmware voodoo"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 25 Brent Baude (RETIRED) gentoo-dev 2009-01-16 17:28:21 UTC
same here on ppc64
Comment 26 Tobias Scherbaum (RETIRED) gentoo-dev 2009-01-18 11:07:58 UTC
(In reply to comment #25)
> same here on ppc64
> 

and same for ppc.

back to [ebuild], please re-add arches once this is fixed. thanks.
Comment 27 Patric Stout 2009-01-19 12:41:07 UTC
OpenTTD doesn't know how to do a 'make check'. Any way to disable this in the ebuild?
Comment 28 Mr. Bones. (RETIRED) gentoo-dev 2009-01-30 14:54:43 UTC
added restrict for test
Comment 29 Robert Buchholz (RETIRED) gentoo-dev 2009-01-30 16:49:34 UTC
Arches, please test and mark stable:
=games-simulation/openttd-0.6.3
Target keywords : "amd64 ppc ppc64 x86"
Comment 30 Markus Meier gentoo-dev 2009-01-30 20:40:43 UTC
amd64/x86 stable
Comment 31 Tobias Scherbaum (RETIRED) gentoo-dev 2009-02-01 21:07:09 UTC
ppc stable
Comment 32 Brent Baude (RETIRED) gentoo-dev 2009-02-02 15:20:08 UTC
ppc64 done
Comment 33 Robert Buchholz (RETIRED) gentoo-dev 2009-03-07 16:31:06 UTC
GLSA 200903-09