Secunia writes: A vulnerability has been reported in OpenTTD, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the "TruncateString()" function in src/gfx.cpp. This can be exploited to potentially cause a buffer overflow via a specially crafted string. Successful exploitation may allow execution of arbitrary code. The vulnerability is reported in versions prior to 0.6.2. SOLUTION: Update to version 0.6.2. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://sourceforge.net/project/shownotes.php?release_id=617243
Created attachment 162239 [details, diff] openttd-0.6.2-truncate-string.patch Just for reference, the patch in question. It also affects 0.5.3 as it is in our tree, a backport should be trivial if the ebuild cannot be bumped to 0.6.
masked games-simulation/openttd until it's fixed.
Created attachment 162242 [details, diff] backported fix for 0.5.x This is the backported patch of openttd-0.6.2-truncate-string.patch. Compiled fine with me and game playes without problems. This patch also works just fine with 0.5.3 because gfx.c files are identical in 0.5.2 and 0.5.3.
This might not be the only buffer overflow fixed in 0.6.2, see http://thread.gmane.org/gmane.comp.security.oss.general/766
As Nico pointed out in the URL above, further patches would need backporting. Is bumping to 0.6.2 an option for us?
CVE-2008-3547 for the Debian issue
CVE-2008-3576 for the TruncateString() Games, any news here?
CVE-2008-3577: Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttd_main function. NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments.
It's masked. We'll fix it when we fix it.
Would it be possible to change the hard mask to only versions before 0.6.3? 0.6.3 fixes all CVEs. As OpenTTD now wants to push out an overlay with ebuilds, the hard mask is holding it back (and I can't find a way to override the hard mask from within an overlay). Thank you in advance.
(In reply to comment #10) > Would it be possible to change the hard mask to only versions before 0.6.3? > 0.6.3 fixes all CVEs. As OpenTTD now wants to push out an overlay with ebuilds, > the hard mask is holding it back (and I can't find a way to override the hard > mask from within an overlay). Thank you in advance. A file named package.unmask in profiles/ should work, I guess, so no need to change the masks in our official tree. games, you should probably bump and unmask, once you've got time.
(In reply to comment #11) > A file named package.unmask in profiles/ should work, I guess, so no need to > change the masks in our official tree. > > games, you should probably bump and unmask, once you've got time. > Exactly my thoughts ... but I couldn't get it to work. Then of course there is a good possibility I am doing something wrong. # cat profiles/package.unmask games-simulation/openttd # emerge -av openttd (still fails) (same for '=games-simulation/openttd-0.6.3' and '<=games-simulation/openttd-0.6.2') .. But okay, I will just wait for someone to official add 0.6.3 in the portage. Tnx for your reply!
Version 0.6.3 is in portage now and unmasked. Can be closed?
(In reply to comment #13) > Version 0.6.3 is in portage now and unmasked. Can be closed? Nah, we need this stable first. 0.6.3 ready to go stable?
(In reply to comment #14) > 0.6.3 ready to go stable? As it use EAPI=2 we should wait for portage to stabilize
But why is it using EAPI=2 in the first place? It is not like it uses any of the new features ...
(In reply to comment #16) > But why is it using EAPI=2 in the first place? It is not like it uses any of > the new features ... The ebuild does, it has USE deps and src_configure. We can either wait this out until portage with EAPI=2 is stable, or create an -r1 that reintroduces built_with_use moves the src_configure code.
Ah, sorry, you are right. I am trying to get the following ebuild in the official portage for ages now .. I seem to fail to do so ;) http://packages.openttd.org/gentoo/overlay/games-simulation/openttd/openttd-0.6.3.ebuild It uses EAPI=1, and is what we as OpenTTD publish as official ebuilds at the moment (as at least the general public can use it ...)
Regarding the status on the openttd website would it be possible to stabilize the ebuild? The last post has been commited on th 27th of November ...
EAPI-2 portage is now stable, is 0.6.3 good to go now?
Robin, do you approve of this going stable?
rbu: +1 from me.
Arches, please test and mark stable: =games-simulation/openttd-0.6.3 Target keywords : "amd64 ppc ppc64 x86"
tests fail on amd64/x86: >>> Test phase [check]: games-simulation/openttd-0.6.3 make -j2 -j1 check make[1]: Entering directory `/var/tmp/portage/games-simulation/openttd-0.6.3/work/openttd-0.6.3/objs/release' [SRC] No such source-file: check.[c|cpp|mm|rc] make[1]: Leaving directory `/var/tmp/portage/games-simulation/openttd-0.6.3/work/openttd-0.6.3/objs/release' cc -Wl,-O1 check.o -o check gcc: check.o: No such file or directory make: *** [check] Error 1 * * ERROR: games-simulation/openttd-0.6.3 failed. * Call stack: * ebuild.sh, line 49: Called src_test * environment, line 2583: Called _eapi0_src_test * ebuild.sh, line 602: Called die * The specific snippet of code: * hasq test $FEATURES && die "Make check failed. See above for details." * The die message: * Make check failed. See above for details. games-simulation/openttd-0.6.3 USE="alsa iconv png truetype zlib -debug -dedicated -scenarios -timidity" Portage 2.1.6.4 (default/linux/x86/2008.0/desktop, gcc-4.1.2, glibc-2.6.1-r0, 2.6.28 i686) ================================================================= System uname: Linux-2.6.28-i686-Intel-R-_Core-TM-2_Duo_CPU_T8300_@_2.40GHz-with-glibc2.0 Timestamp of tree: Thu, 15 Jan 2009 20:30:01 +0000 app-shells/bash: 3.2_p39 dev-java/java-config: 1.3.7-r1, 2.1.6-r1 dev-lang/python: 2.4.4-r14, 2.5.2-r7 dev-python/pycrypto: 2.0.1-r6 dev-util/cmake: 2.4.6-r1 sys-apps/baselayout: 1.12.11.1 sys-apps/sandbox: 1.2.18.1-r2 sys-devel/autoconf: 2.13, 2.63 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2 sys-devel/binutils: 2.18-r3 sys-devel/gcc-config: 1.4.0-r4 sys-devel/libtool: 1.5.26 virtual/os-headers: 2.6.27-r2 ACCEPT_KEYWORDS="x86" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=i686 -pipe" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /opt/openfire/resources/security/ /opt/openjms/config /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/lib/fax /usr/share/config /var/bind /var/lib/hsqldb /var/qmail/alias /var/qmail/control /var/spool/fax/etc /var/spool/torque" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d" CXXFLAGS="-O2 -march=i686 -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="collision-protect distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict test unmerge-orphans userfetch userpriv usersandbox" GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo" LDFLAGS="-Wl,-O1" LINGUAS="en en_GB de" MAKEOPTS="-j2" PKGDIR="/mnt/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="X acl acpi alsa apache2 avahi berkdb bluetooth branding bzip2 cairo cdr cli cracklib crypt cups dbus dri dvd dvdr dvdread eds emboss encode esd evo examples fam firefox fortran gdbm gif gnome gpm gstreamer gtk hal iconv ipv6 isdnlog jpeg kde ldap libnotify mad midi mikmod mp3 mpeg mudflap ncurses nls nptl nptlonly ogg opengl openmp pam pcre pdf perl png ppds pppd python qt3 qt3support qt4 quicktime readline reflection sdl session source spell spl ssl startup-notification svg sysfs tcpd test tiff truetype unicode usb vorbis win32codecs x86 xml xorg xulrunner xv zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en en_GB de" USERLAND="GNU" VIDEO_CARDS="fbdev glint i810 intel mach64 mga neomagic nv r128 radeon savage sis tdfx trident vesa vga via vmware voodoo" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
same here on ppc64
(In reply to comment #25) > same here on ppc64 > and same for ppc. back to [ebuild], please re-add arches once this is fixed. thanks.
OpenTTD doesn't know how to do a 'make check'. Any way to disable this in the ebuild?
added restrict for test
amd64/x86 stable
ppc stable
ppc64 done
GLSA 200903-09
