bugtraq - Re: [oss-security] CVE Request: Planeshift buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 17 May 2012 19:14:57 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Andres Gomez <agomez@...idsignal.com>
CC: oss-security@...ts.openwall.com, bugtraq@...urityfocus.com,
  vuln@...unia.com
Subject: Re: [oss-security] CVE Request: Planeshift buffer overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/17/2012 03:29 PM, Andres Gomez wrote:
> Planeshift is an online multiplayer role playing game which is
> open source (http://en.wikipedia.org/wiki/PlaneShift_(video_game))
> and "chatbubbles.xml" is a sort of configuration file for chat
> windows inside the game, so I can't be changed directly by remote
> users.

It doesn't sounds like any security boundary is being crossed.

If you can edit that file I'm guessing you can also modify the other
game files (executables, libraries, etc.), so there is no escalation
of privilege as far as I can tell. If the ifle is owned by a unique
user (e.g. it's a local config thing) again, if you can edit a users
files you already have access, so no escalation of privilege. If this
is correct then I will not be assigning a CVE.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJPtaKRAAoJEBYNRVNeJnmThwQP/iLSfGP5gGSQOIN8skNBns6S
dr/Obla/Xjy1iADbIAuTTYcvvdp07HYlJANDN+VMKSPRQVpmhZhbr0hVq7FNsNZ9
L2j2BW6kpde0PxhKV6hOpLjUOATgfNYg573XPZNUKU7qEqRVAFasYjqikEiGV+lq
h63ISGt/bLVvTyZaJAqeUkZz6AWa9sQBYyJ4ixYatyuipA67dfD4bqkbpYwiYtV1
uy7b24hvW4GTV4bkz3LbZUNxzJuxCn2fv/HCMbbgXV6zlbw9/IhGrQfSyYOGzcn3
ZJtsByq+kzDDZdZ5QE3fGQRud0+5a4dc00cth9gyh76wHgfH6GGNDcdA3YVzcmBv
8rPR36LcUHvYCRLzn4+aP6A/y3FZOK++P/f5NofkuAMQsXmenGKhWuL3nex7LGRV
NYfycw+T89F1wPK5EB6HN0xjmfSxDKgsajHKuV4iJ0EqPwA45zVEFeFSAgqMhVBi
rVofuOF46iBeHYQHzW8tKU6y13+uC6kMh78U9ekFR1sAR5pYrot5BakBJkCsWUo7
6X6NVl68OXiDXo8TkI9/OuDJFI7VVnzj2ccsOVRmAB+DKIqqRa6BRvv5aZ50OpfA
Q+0+0aPsLWJ7lMSDizvFDDw0PhdqPq3vkinBBKRVvSbs9UG1KnNt7ADzn7O7vigR
dXWRpeRoRNhHO/dfQawV
=Gbu8
-----END PGP SIGNATURE-----