InfoSect's Month of Pointless Bugs (#7)

Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #7

The rockdodger game doesn't drop privileges, then accesses files. This is a similar vulnerability to Bug #5

FILE *hs_fopen(const char *mode) { mode_t mask; char s[1024]; FILE *f = NULL; s[sizeof(s) - 1] = '\0'; snprintf(s, sizeof(s) - 1, "%s/rockdodger.scores", GAMESDIR); mask = umask(0111); if((f = fopen(s, mode)) == NULL) { umask(0117); snprintf(s, sizeof(s) - 1, "%s/.rockdodger_high", getenv("HOME")); if((f = fopen(s, mode)) == NULL) { perror(s); fprintf(stderr, "Could not open highscore file '%s', mode '%s'!\n", s, mode); } } umask(mask); return f; }

If you point HOME to a games writable directory, or use symbolic links for .rockdoger_high, you can write or overwrite games owned files.


Popular posts from this blog

NetBSD kernel wscons IOCTL vulnerable bug class

InfoSect's Month of Pointless Bugs (#1, #2)

InfoSect's Month of Pointless Bugs (#3)