Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.

Several vulnerabilities have been discovered in OpenTTD, a transport business simulation game. Multiple buffer overflows and off-by-one errors allow remote attackers to cause denial of service.

The remote host is affected by the vulnerability described in GLSA-201111-03 (OpenTTD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenTTD. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code with the privileges of       the OpenTTD process or cause a Denial of Service. Local users could cause       a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The OpenTTD Team reports :

Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.

This update fixes some crash issues which can have security implications.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
57526	Debian DSA-2386-1 : openttd - several vulnerabilities	Nessus	Debian Local Security Checks	high
56807	GLSA-201111-03 : OpenTTD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
56523	FreeBSD : OpenTTD -- Denial of service via improperly validated commands (e77befb5-f3f9-11e0-8b5c-b482fe3f522d)	Nessus	FreeBSD Local Security Checks	high
56362	Fedora 16 : openttd-1.1.3-1.fc16 (2011-12945)	Nessus	Fedora Local Security Checks	high
56234	Fedora 14 : openttd-1.1.3-1.fc14 (2011-12975)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-3341

critical

Tenable Plugins

high

high

high

high

high