InfoSect's Month of Pointless Bugs (#6)
Dr Silvio Cesare
omega-rpg is sgid games.
The code tries to drop privs using seteuid/setreuid when it should use setegid/setregid.
void change_to_user_perms(void) { #if (defined( BSD ) || defined( SYSV )) && !defined(__EMX__) && !defined(__DJGPP__) #ifdef BSD setreuid(game_uid, user_uid); #else /* SYSV */ seteuid(user_uid); #endif /* BSD */ #endif /* BSD || SYSV */ } void change_to_game_perms(void) { #if (defined( BSD ) || defined( SYSV )) && !defined(__EMX__) && !defined(__DJGPP__) #ifdef BSD setreuid(user_uid, game_uid); #else /* SYSV */ seteuid(game_uid); #endif /* BSD */ #endif /* BSD || SYSV */ }