Description
Buffer overflow in the server in OpenTTD 0.6.1 and earlier allows remote authenticated users to cause a denial of service (persistent game disruption) or possibly execute arbitrary code via vectors involving many long names for "companies and clients."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openttd | 0.6.2-1 | — |
| Debian 13 | openttd | 0.6.2-1 | — |
| Debian 12 | openttd | 0.6.2-1 | — |
References
- 34161 third-party-advisory
- [oss-security] 20080805 Re: CVE id request: openttd mailing-list
- GLSA-200903-09 vendor-advisory
- [oss-security] 20080807 Re: CVE id request: openttd mailing-list
- [oss-security] 20080804 CVE id request: openttd mailing-list
- http://sourceforge.net/project/shownotes.php?release_id=617243
- openttd-companies-clients-bo(49221) vdb-entry
- [oss-security] 20080805 Re: CVE id request: openttd mailing-list
- http://bugs.gentoo.org/show_bug.cgi?id=233929
- http://bugs.debian.org/493714