[14948] in bugtraq
Re: xsoldier update for Linux Mandrake
daemon@ATHENA.MIT.EDU (Cashdollar, Larry)
Thu May 18 17:02:23 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.21.0005181017010.22090-100000@localhost.localdomain>
Date: Thu, 18 May 2000 10:22:32 -0700
Reply-To: lwc@VAPID.DHS.ORG
From: "Cashdollar, Larry" <lwc@VAPID.DHS.ORG>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <00051713460500.00830@sQa.speedbros.org>
> Great little shoot 'em up game in the style of galaga. Very neat
> graphics, but there's no sound support yet.
>
I actually wrote an exploit for this and posted it on VUL-DEV. The
exploit would get egid 12 (games) if I had bothered to put a setregid()
call in the shellcode. My attempts had failed. It will however get euid
0 from a default source installation that placed xsoldier in
/usr/local/games as setuid root.
I didnt think it was interesting enough to post on bugtraq, but since this
came up here is a link to the exploit if anyone wants to toy with it.
http://vapid.dhs.org/xsol-x.c
-- Larry
