CVE-2008-3577: Buffer Overflow
Published Aug 10, 2008
·Updated
Buffer overflow in src/openttd.cpp in OpenTTD before 0.6.2 allows local users to execute arbitrary code via a large filename supplied to the "-g" parameter in the ttdmain function. NOTE: it is unlikely that this issue would cross privilege boundaries in typical environments.
Affected Software
48 affected components
OpenTTD OpenTTD=0.1.1
OpenTTD OpenTTD=0.1.2
OpenTTD OpenTTD=0.1.3
OpenTTD OpenTTD=0.1.4
OpenTTD OpenTTD=0.2.0
OpenTTD OpenTTD=0.2.1
OpenTTD OpenTTD=0.3.0
OpenTTD OpenTTD=0.3.1
OpenTTD OpenTTD=0.3.2
OpenTTD OpenTTD=0.3.2.1
OpenTTD OpenTTD=0.3.3
OpenTTD OpenTTD=0.3.4
OpenTTD OpenTTD=0.3.5
OpenTTD OpenTTD=0.3.6
OpenTTD OpenTTD=0.4.0
OpenTTD OpenTTD=0.4.0.1
OpenTTD OpenTTD=0.4.5
OpenTTD OpenTTD=0.4.6
OpenTTD OpenTTD=0.4.7
OpenTTD OpenTTD=0.4.8
OpenTTD OpenTTD=0.4.8-rc1
OpenTTD OpenTTD=0.4.8-rc2
OpenTTD OpenTTD=0.5.0
OpenTTD OpenTTD=0.5.0-rc1
OpenTTD OpenTTD=0.5.0-rc2
OpenTTD OpenTTD=0.5.0-rc3
OpenTTD OpenTTD=0.5.0-rc4
OpenTTD OpenTTD=0.5.0-rc5
OpenTTD OpenTTD=0.5.1
OpenTTD OpenTTD=0.5.1-rc1
OpenTTD OpenTTD=0.5.1-rc2
OpenTTD OpenTTD=0.5.1-rc3
OpenTTD OpenTTD=0.5.2
OpenTTD OpenTTD=0.5.2-rc1
OpenTTD OpenTTD=0.5.3
OpenTTD OpenTTD=0.5.3-rc1
OpenTTD OpenTTD=0.5.3-rc2
OpenTTD OpenTTD=0.5.3-rc3
OpenTTD OpenTTD=0.6.0
OpenTTD OpenTTD=0.6.0-beta1
OpenTTD OpenTTD=0.6.0-beta2
OpenTTD OpenTTD=0.6.0-beta3
OpenTTD OpenTTD=0.6.0-beta4
OpenTTD OpenTTD=0.6.0-beta5
OpenTTD OpenTTD=0.6.0-rc1
OpenTTD OpenTTD=0.6.1
OpenTTD OpenTTD=0.6.1-rc1
OpenTTD OpenTTD=0.6.1-rc2
Event History
Aug 10, 2008
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3577?
CVE-2008-3577 is classified as a medium severity vulnerability.
2
How do I fix CVE-2008-3577?
To fix CVE-2008-3577, upgrade OpenTTD to version 0.6.2 or later.
3
Who is affected by CVE-2008-3577?
CVE-2008-3577 affects users of OpenTTD versions prior to 0.6.2.
4
What type of vulnerability is CVE-2008-3577?
CVE-2008-3577 is a buffer overflow vulnerability.
5
Can CVE-2008-3577 lead to arbitrary code execution?
Yes, CVE-2008-3577 allows local users to execute arbitrary code via a crafted filename.