The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map.

The remote host is affected by the vulnerability described in GLSA-201407-01 (OpenTTD: Denial of Service)

    The vulnerability is caused due to missing out-of-bound check within the       &ldquo;HandleCrashedAircraft()&rdquo; function.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update fixes the following security issue with openttd :

  - add patch 60.patch: Aircraft crashing near the map's     border due to a lack of airports could trigger a crash     [CVE-2013-6411] [FS#5820] (bnc#853041)

Fixes CVE-2013-6411: DoS using forcefully crashed aircrafts

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The OpenTTD Team reports :

The problem is caused by incorrectly handling the fact that the aircraft circling the corner airport will be outside of the bounds of the map. In the 'out of fuel' crash code the height of the tile under the aircraft is determined. In this case that means a tile outside of the allocated map array, which could occasionally trigger invalid reads.

ID	Name	Product	Family	Severity
76397	GLSA-201407-01 : OpenTTD: Denial of Service	Nessus	Gentoo Local Security Checks	medium
75244	openSUSE Security Update : openttd (openSUSE-SU-2013:1932-1)	Nessus	SuSE Local Security Checks	medium
71625	Fedora 19 : openttd-1.3.3-1.fc19 (2013-23432)	Nessus	Fedora Local Security Checks	medium
71623	Fedora 18 : openttd-1.3.3-1.fc18 (2013-23378)	Nessus	Fedora Local Security Checks	medium
71621	Fedora 20 : openttd-1.3.3-1.fc20 (2013-23339)	Nessus	Fedora Local Security Checks	medium
71166	FreeBSD : OpenTTD -- Denial of service using forcefully crashed aircrafts (d2073237-5b52-11e3-80f7-c86000cbc6ec)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-6411

high

Tenable Plugins

medium

medium

medium

medium

medium

medium