Vulnerability Name:

CVE-2011-3341 (CCN-69593)

Assigned:2011-09-02
Published:2011-09-02
Updated:2012-01-19
Summary:Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-189
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: OpenTTD Web Site
FS#4717 - Fix NAME, PLYR, CHTS chunk loaders

Source: CONFIRM
Type: Patch
http://bugs.openttd.org/task/4745

Source: CONFIRM
Type: Patch
http://bugs.openttd.org/task/4745/getfile/7707/fixcmds.diff

Source: MITRE
Type: CNA
CVE-2011-3341

Source: FEDORA
Type: UNKNOWN
FEDORA-2011-12975

Source: MLIST
Type: Patch
[oss-security] 20110902 CVE request for OpenTTD

Source: MLIST
Type: Patch
[oss-security] 20110906 Re: CVE request for OpenTTD

Source: CCN
Type: SA45832
OpenTTD Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
46075

Source: CONFIRM
Type: UNKNOWN
http://security.openttd.org/en/CVE-2011-3341

Source: DEBIAN
Type: UNKNOWN
DSA-2386

Source: DEBIAN
Type: DSA-2386
openttd -- several vulnerabilities

Source: CCN
Type: oss-security Mailing List, Fri, 02 Sep 2011 23:04:18 +0200
CVE request for OpenTTD

Source: CCN
Type: OSVDB ID: 75110
OpenTTD order_cmd.cpp CMD_INSERT_ORDER Remote Command Injection

Source: BID
Type: UNKNOWN
49439

Source: CCN
Type: BID-49439
OpenTTD Multiple Buffer Overflow Vulnerabilities and Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
openttd-commands-code-execution(69593)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:openttd:openttd:0.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.3.7:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.8:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.8:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.4.8:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.0:rc4:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.0:rc5:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.1:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.1:rc3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.2:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.3:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.3:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.5.3:rc3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.0:beta5:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.1:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.2:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.2:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.6.3:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.1:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.1:rc3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.2:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.2:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.3:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.3:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.4:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:0.7.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.1:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.2:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.3:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.4:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.5:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:beta5:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:*:*:*:*:*:*:*:* (Version <= 1.1.2)
  • OR cpe:/a:openttd:openttd:1.1.2:rc1:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.1.2:rc2:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:openttd:openttd:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:openttd:openttd:1.0.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:14577
    P
    		DSA-2386-1 openttd -- several
    2014-06-23
    oval:com.ubuntu.precise:def:20113341000
    V
    		CVE-2011-3341 on Ubuntu 12.04 LTS (precise) - medium.
    2011-09-08
    BACK
    openttd openttd 0.1.1
    openttd openttd 0.1.2
    openttd openttd 0.1.3
    openttd openttd 0.1.4
    openttd openttd 0.2.0
    openttd openttd 0.2.1
    openttd openttd 0.3.0
    openttd openttd 0.3.1
    openttd openttd 0.3.2
    openttd openttd 0.3.2.1
    openttd openttd 0.3.3
    openttd openttd 0.3.4
    openttd openttd 0.3.5
    openttd openttd 0.3.6
    openttd openttd 0.3.7
    openttd openttd 0.4.0
    openttd openttd 0.4.0.1
    openttd openttd 0.4.5
    openttd openttd 0.4.6
    openttd openttd 0.4.7
    openttd openttd 0.4.8
    openttd openttd 0.4.8 rc1
    openttd openttd 0.4.8 rc2
    openttd openttd 0.5.0
    openttd openttd 0.5.0 rc1
    openttd openttd 0.5.0 rc2
    openttd openttd 0.5.0 rc3
    openttd openttd 0.5.0 rc4
    openttd openttd 0.5.0 rc5
    openttd openttd 0.5.1
    openttd openttd 0.5.1 rc1
    openttd openttd 0.5.1 rc2
    openttd openttd 0.5.1 rc3
    openttd openttd 0.5.2
    openttd openttd 0.5.2 rc1
    openttd openttd 0.5.3
    openttd openttd 0.5.3 rc1
    openttd openttd 0.5.3 rc2
    openttd openttd 0.5.3 rc3
    openttd openttd 0.6.0
    openttd openttd 0.6.0 beta1
    openttd openttd 0.6.0 beta2
    openttd openttd 0.6.0 beta3
    openttd openttd 0.6.0 beta4
    openttd openttd 0.6.0 beta5
    openttd openttd 0.6.0 rc1
    openttd openttd 0.6.1
    openttd openttd 0.6.1 rc1
    openttd openttd 0.6.1 rc2
    openttd openttd 0.6.2
    openttd openttd 0.6.2 rc1
    openttd openttd 0.6.2 rc2
    openttd openttd 0.6.3
    openttd openttd 0.6.3 rc1
    openttd openttd 0.7.0
    openttd openttd 0.7.0 beta1
    openttd openttd 0.7.0 beta2
    openttd openttd 0.7.0 rc1
    openttd openttd 0.7.0 rc2
    openttd openttd 0.7.1
    openttd openttd 0.7.1 rc1
    openttd openttd 0.7.1 rc2
    openttd openttd 0.7.1 rc3
    openttd openttd 0.7.2
    openttd openttd 0.7.2 rc1
    openttd openttd 0.7.2 rc2
    openttd openttd 0.7.3
    openttd openttd 0.7.3 rc1
    openttd openttd 0.7.3 rc2
    openttd openttd 0.7.4
    openttd openttd 0.7.4 rc1
    openttd openttd 0.7.5
    openttd openttd 0.7.5 rc1
    openttd openttd 1.0.0
    openttd openttd 1.0.0 beta1
    openttd openttd 1.0.0 beta2
    openttd openttd 1.0.0 beta3
    openttd openttd 1.0.0 beta4
    openttd openttd 1.0.0 rc1
    openttd openttd 1.0.0 rc2
    openttd openttd 1.0.0 rc3
    openttd openttd 1.0.1
    openttd openttd 1.0.1 rc1
    openttd openttd 1.0.1 rc2
    openttd openttd 1.0.2
    openttd openttd 1.0.2 rc1
    openttd openttd 1.0.3
    openttd openttd 1.0.3 rc1
    openttd openttd 1.0.4
    openttd openttd 1.0.4 rc1
    openttd openttd 1.0.5
    openttd openttd 1.0.5 rc1
    openttd openttd 1.0.5 rc2
    openttd openttd 1.1.0
    openttd openttd 1.1.0 beta1
    openttd openttd 1.1.0 beta2
    openttd openttd 1.1.0 beta3
    openttd openttd 1.1.0 beta4
    openttd openttd 1.1.0 beta5
    openttd openttd 1.1.0 rc1
    openttd openttd 1.1.0 rc2
    openttd openttd 1.1.0 rc3
    openttd openttd 1.1.1
    openttd openttd 1.1.1 rc1
    openttd openttd *
    openttd openttd 1.1.2 rc1
    openttd openttd 1.1.2 rc2
    openttd openttd 1.0.0
    openttd openttd 1.0.1
    openttd openttd 1.0.2
    openttd openttd 1.0.3
    openttd openttd 1.0.4