Bugtraq mailing list archives
Re: Linux GNOME exploit
From: alan () LXORGUK UKUU ORG UK (Alan Cox)
Date: Mon, 27 Sep 1999 19:04:59 +0100
Virtually any program using the GNOME libraries is vulnerable to a buffer overflow attack. The attack comes in the form: /path/to/gnome/prog --enable-sound --espeaker=$80bytebuffer
I can duplicate this for gnome-libs 1.0.8 but not with gnome-libs 1.0.15
tried it on (the irony) /usr/games/nethack, which is SGID root by default on RH6.0. An attack on any program will look something like this:
Red Hat 6.0 doesn't include nethack. It is shipped on "Power Tools" but not a Gnome version. Some 6.0 games are setgid "games". I'm not sure it will give a setgid shell on those because the gnome games wrapper is at least intended to drop privs before the program does anything. It may do.
Linux Mandrake release 6.0 (Venus)
Mandrake != Red Hat not remotely. Alan
Current thread:
- Linux GNOME exploit Brock Tellier (Sep 23)
- Re: Linux GNOME exploit Alan Cox (Sep 27)
- Re: Linux GNOME exploit Brock Tellier (Sep 27)
- Re: Linux GNOME exploit Matt Wilson (Sep 27)
- Re: Linux GNOME exploit Ron DuFresne (Sep 29)
- Re: Linux GNOME exploit Slackware Security Team (Sep 29)
- Multiple Vendor ARCAD permission problems Brock Tellier (Sep 29)
- Re: Linux GNOME exploit Chmouel Boudjnah (Sep 27)
- <Possible follow-ups>
- Re: Linux GNOME exploit Elliot Lee (Sep 27)
- Re: Linux GNOME exploit Adam Sampson (Sep 28)
- Re: Linux GNOME exploit Thomas Biege (Sep 28)