[6192] in bugtraq
x11amp bug
daemon@ATHENA.MIT.EDU (Jeff Johnson)
Sun Mar 1 13:37:03 1998
Date: Sun, 1 Mar 1998 13:00:33 -0500
Reply-To: Jeff Johnson <trn@FLINET.COM>
From: Jeff Johnson <trn@FLINET.COM>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: Automatic digest processor <LISTSERV@NETSPACE.ORG> "BUGTRAQ
Digest - 27 Feb 1998 to 28 Feb 1998" (Mar 1, 12:03am)
> x11 audio mpeg player (x11amp) version 0.65, when installed setuid root
> (as suggested by the README file), creates playlist files in ~/.x11amp
> while making 'root' the owner of these plaintext files (instead of the
> proper user). unfortunatelly, the program DOES follow symlinks, and
> overwriting for instance /etc/shadow is therefore trivial:
>
> mkdir ~/.x11amp
> ln -s /etc/shadow ~/.x11amp/ekl
>
> now run x11amp, get into the playlist menu, select 'ekl', mark all the
> entries and hit 'delete'. no matter if the prg crashes (it might),
> /etc/shadow is gone, anyway.
>-- End of excerpt from Automatic digest processor
you can also read files not owned by you, but I have not found a way to display
them yet. But, if another user has a lot of mp3 files, fire up x11amp and
you'll be able to play them. also, start x11amp with a VERY VERY VERY LONG
filename and it seg faults.... buffer overflow?
--
trn@flinet.com - [LwZ] - http://www.flinet.com/~trn
I poured Spot remover on my dog. Now he's gone. *sniff*
