Bugtraq: Re: Linux GNOME exploit

[alan () LXORGUK UKUU ORG UK (Alan Cox)]

>     Virtually any program using the GNOME libraries is vulnerable to a
> buffer overflow attack.  The attack comes in the form:
>
> /path/to/gnome/prog --enable-sound --espeaker=$80bytebuffer
I can duplicate this for gnome-libs 1.0.8 but not with gnome-libs 1.0.15

> tried it on (the irony) /usr/games/nethack, which is SGID root by default
> on RH6.0.  An attack on any program will look something like this:
Red Hat 6.0 doesn't include nethack. It is shipped on "Power Tools" but not
a Gnome version.

Some 6.0 games are setgid "games". I'm not sure it will give a setgid shell on
those because the gnome games wrapper is at least intended to drop privs
before the program does anything. It may do.

> Linux Mandrake release 6.0 (Venus)
Mandrake != Red Hat

not remotely.

Alan