| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20041004192346.GA602@steve.org.uk> Date: Mon, 4 Oct 2004 20:23:46 +0100 From: Steve Kemp <steve@...ve.org.uk> To: Security Team <security@...admin.com> Cc: bugtraq@...urityfocus.com, bugs@...uritytracker.com, news@...uriteam.com, vuln@...unia.com Subject: Re: Buffer Overflow in Spider game On Sun, Oct 03, 2004 at 12:05:23PM +0300, Security Team wrote: > A vulnerability has been discovered in the game spider, an application > contained in the Debian GNU/Linux distribution. > The vulnerability allows a local attacker to gain elevated privileges by > overflowing the -s parameter. > > Impact: > The attacker can gain group privileges. By default "games". Neither Debian stable nor unstable contain any spider binaries setuid or setgid. Debian Stable - spider 1.1-9: uml201:~# ls -l /usr/X11R6/bin/*spider* -rwxr-xr-x 1 root root 53628 Dec 13 2001 /usr/X11R6/bin/round.spider -rwxr-xr-x 1 root root 54396 Dec 13 2001 /usr/X11R6/bin/small.spider lrwxr-xr-x 1 root root 27 Oct 4 19:23 /usr/X11R6/bin/spider -> /usr/X11R6/bin/round.spider Debian Unstable - spider 1.1-11: skx@...py:~$ ls -l /usr/X11R6/bin/*spider* -rwxr-xr-x 1 root root 61048 2004-09-04 12:11 /usr/X11R6/bin/round.spider -rwxr-xr-x 1 root root 57624 2004-09-04 12:11 /usr/X11R6/bin/small.spider lrwxrwxrwx 1 root root 12 2004-10-04 20:10 /usr/X11R6/bin/spider -> round.spider You can find a list of setuid/setgid binaries contained in Debian stable and unstable at: http://www.setuid.org/ Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit
Powered by blists - more mailing lists