FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-3436

This CVE name corresponds to:

Entered	Topic
2012-08-18	OpenTTD -- Denial of Service

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-3436 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-3436
Phase	Assigned(20120614)

Description

OpenTTD 0.6.0 through 1.2.1 does not properly validate requests to clear a water tile, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a certain sequence of steps related to "the water/coast aspect of tiles which also have railtracks on one half."

References

Source	Reference
MLIST	[oss-security] 20120727 CVE request for OpenTTD
MLIST	[oss-security] 20120728 Re: CVE request for OpenTTD
MLIST	[oss-security] 20120731 Re: CVE request for OpenTTD
CONFIRM	http://bugs.openttd.org/task/5254
CONFIRM	http://security.openttd.org/en/CVE-2012-3436
CONFIRM	http://vcs.openttd.org/svn/changeset/24439
CONFIRM	http://vcs.openttd.org/svn/changeset/24449
SUSE	openSUSE-SU-2012:1063
BID	54720
SECUNIA	50042
XF	openttd-water-dos(77266)