CVE:CVE-2008-3547
CNNVD:CNNVD-200903-187
Openttd是游戏运输大亨(Transport Tycoon)的改良版本。
Openttd的src/gfx.cpp文件中没有正确地过滤对TruncateString()函数的输入，如果远程攻击者向该函数提交了超长的字符串参数的话就可以触发缓冲区溢出，导致执行任意指令。
solution:Upgrade openttd openttd to a higher version than 0.6.1,0.1.1,0.1.2,0.1.3,0.1.4,0.2.0,0.2.1,0.3.0,0.3.1,0.3.2,0.3.2.1,0.3.3,0.3.4,0.3.5,0.3.6,0.3.7,0.4.0,0.4.0.1,0.4.5,0.4.6,0.4.7,0.4.8,0.4.8:rc1,0.4.8:rc2,0.5.0,0.5.0:rc1,0.5.0:rc2,0.5.0:rc3,0.5.0:rc4,0.5.0:rc5,0.5.1,0.5.1:rc1,0.5.1:rc2,0.5.1:rc3,0.5.2,0.5.2:rc1,0.5.3,0.5.3:rc1,0.5.3:rc2,0.5.3:rc3,0.6.0,0.6.0:beta1,0.6.0:beta2,0.6.0:beta3,0.6.0:beta4,0.6.0:beta5,0.6.0:rc1,0.6.1:rc1,0.6.1:rc2,and avoid the version (,0.6.1],0.1.1,0.1.2,0.1.3,0.1.4,0.2.0,0.2.1,0.3.0,0.3.1,0.3.2,0.3.2.1,0.3.3,0.3.4,0.3.5,0.3.6,0.3.7,0.4.0,0.4.0.1,0.4.5,0.4.6,0.4.7,0.4.8,0.4.8:rc1,0.4.8:rc2,0.5.0,0.5.0:rc1,0.5.0:rc2,0.5.0:rc3,0.5.0:rc4,0.5.0:rc5,0.5.1,0.5.1:rc1,0.5.1:rc2,0.5.1:rc3,0.5.2,0.5.2:rc1,0.5.3,0.5.3:rc1,0.5.3:rc2,0.5.3:rc3,0.6.0,0.6.0:beta1,0.6.0:beta2,0.6.0:beta3,0.6.0:beta4,0.6.0:beta5,0.6.0:rc1,0.6.1:rc1,0.6.1:rc2