Bugtraq mailing list archives

Re: Vunerability in Lizards game


From: olaf () BIGRED INKA DE (Olaf Titz)
Date: Thu, 13 Nov 1997 15:01:00 +0100


Recently looking through the source of the suid root game called Lizards I

Why is this suid root? I assume it uses svgalib and the mistaken notion that
svgalib requires programs setuid root is still in every doc and HOWTO about
svgalib programming several years after this has been fixed.

Use "ioperm" <URL:http://www.inka.de/~bigred/sw/ioperm.txt> to run any
svgalib program (and more) without making them setuid. svgalib does properly
support running with this tool for a long time now.

There is no excuse at all for making any game setuid root.

olaf



Current thread: