Multiple use-after-free vulnerabilities in OpenTTD 1.0.x before 1.0.5 allow (1) remote attackers to cause a denial of service (invalid write and daemon crash) by abruptly disconnecting during transmission of the map from the server, related to network/network_server.cpp; (2) remote attackers to cause a denial of service (invalid read and daemon crash) by abruptly disconnecting, related to network/network_server.cpp; and (3) remote servers to cause a denial of service (invalid read and application crash) by forcing a disconnection during the join process, related to network/network.cpp.

The remote host is affected by the vulnerability described in GLSA-201111-03 (OpenTTD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenTTD. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code with the privileges of       the OpenTTD process or cause a Denial of Service. Local users could cause       a Denial of Service.
  Workaround :

    There is no known workaround at this time.

- 1.0.5

    - fixes CVE-2010-4168 Denial of service (server/client)       via invalid read

    - switched to using the XZ tarball

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The OpenTTD Team reports :

When a client disconnects, without sending the 'quit' or 'client error' message, the server has a chance of reading and writing a just freed piece of memory. The writing can only happen while the server is sending the map. Depending on what happens directly after freeing the memory there is a chance of segmentation fault, and thus a denial of service.

ID	Name	Product	Family	Severity
56807	GLSA-201111-03 : OpenTTD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
51148	Fedora 14 : openttd-1.0.5-1.fc14 (2010-18572)	Nessus	Fedora Local Security Checks	medium
51147	Fedora 13 : openttd-1.0.5-1.fc13 (2010-18571)	Nessus	Fedora Local Security Checks	medium
50699	FreeBSD : OpenTTD -- Denial of service (server/client) via invalid read (373e412e-f748-11df-96cd-0015f2db7bde)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-4168

high

Tenable Plugins

high

medium

medium

medium