[12024] in bugtraq
Re: Linux GNOME exploit
daemon@ATHENA.MIT.EDU (Alan Cox)
Tue Sep 28 13:59:27 1999
Content-Type: text
Message-Id: <E11Vf93-0008BR-00@the-village.bc.nu>
Date: Mon, 27 Sep 1999 19:04:59 +0100
Reply-To: Alan Cox <alan@LXORGUK.UKUU.ORG.UK>
From: Alan Cox <alan@LXORGUK.UKUU.ORG.UK>
X-To: btellier@WEBLEY.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <067801bf061c$6f99bae0$3177a8c0@webley> from "Brock Tellier" at
Sep 23, 99 06:36:18 pm
> Virtually any program using the GNOME libraries is vulnerable to a
> buffer overflow attack. The attack comes in the form:
>
> /path/to/gnome/prog --enable-sound --espeaker=$80bytebuffer
I can duplicate this for gnome-libs 1.0.8 but not with gnome-libs 1.0.15
> tried it on (the irony) /usr/games/nethack, which is SGID root by default
> on RH6.0. An attack on any program will look something like this:
Red Hat 6.0 doesn't include nethack. It is shipped on "Power Tools" but not
a Gnome version.
Some 6.0 games are setgid "games". I'm not sure it will give a setgid shell on
those because the gnome games wrapper is at least intended to drop privs
before the program does anything. It may do.
> Linux Mandrake release 6.0 (Venus)
Mandrake != Red Hat
not remotely.
Alan
