bugtraq - Re: Buffer Overflow in Spider game

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 4 Oct 2004 20:23:46 +0100
From: Steve Kemp <steve@...ve.org.uk>
To: Security Team <security@...admin.com>
Cc: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, vuln@...unia.com
Subject: Re: Buffer Overflow in Spider game


On Sun, Oct 03, 2004 at 12:05:23PM +0300, Security Team wrote:

> A vulnerability has been discovered in the game spider, an application
> contained in the Debian GNU/Linux distribution.
> The vulnerability allows a local attacker to gain elevated privileges by
> overflowing the -s parameter.
> 
> Impact:
> The attacker can gain group privileges. By default "games".

  Neither Debian stable nor unstable contain any spider binaries
 setuid or setgid.

  Debian Stable   - spider 1.1-9:
uml201:~# ls -l /usr/X11R6/bin/*spider*
-rwxr-xr-x    1 root     root        53628 Dec 13  2001 /usr/X11R6/bin/round.spider
-rwxr-xr-x    1 root     root        54396 Dec 13  2001 /usr/X11R6/bin/small.spider
lrwxr-xr-x    1 root     root           27 Oct  4 19:23 /usr/X11R6/bin/spider -> /usr/X11R6/bin/round.spider

  Debian Unstable - spider 1.1-11:

skx@...py:~$ ls -l /usr/X11R6/bin/*spider*
-rwxr-xr-x  1 root root 61048 2004-09-04 12:11 /usr/X11R6/bin/round.spider
-rwxr-xr-x  1 root root 57624 2004-09-04 12:11 /usr/X11R6/bin/small.spider
lrwxrwxrwx  1 root root    12 2004-10-04 20:10 /usr/X11R6/bin/spider -> round.spider


  You can find a list of setuid/setgid binaries contained in Debian
 stable and unstable at:

	http://www.setuid.org/

Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit