InfoSect's Month of Pointless Bugs (#6)

Dr Silvio Cesare


InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #6

omega-rpg is sgid games.

The code tries to drop privs using seteuid/setreuid when it should use setegid/setregid.

void change_to_user_perms(void) { #if (defined( BSD ) || defined( SYSV )) && !defined(__EMX__) && !defined(__DJGPP__) #ifdef BSD setreuid(game_uid, user_uid); #else /* SYSV */ seteuid(user_uid); #endif /* BSD */ #endif /* BSD || SYSV */ } void change_to_game_perms(void) { #if (defined( BSD ) || defined( SYSV )) && !defined(__EMX__) && !defined(__DJGPP__) #ifdef BSD setreuid(user_uid, game_uid); #else /* SYSV */ seteuid(game_uid); #endif /* BSD */ #endif /* BSD || SYSV */ }

Popular posts from this blog

Empowering Women in Cybersecurity: InfoSect's 2024 Training Initiative

C++ Memory Corruption (std::string) - part 4

C++ Memory Corruption (std::vector) - part 2