One of the previously examined programs which had a
hole was crawl. That involved the use of environmental
variables.
The new hole is the execution of commands without
qualifying their paths, and without dropping privileges.
The new DSA covers it:
http://www.debian.org/security/2006/dsa-949
An interesting problem to fix. The program saves
games beneath /var/games/crawl/ so it needs gid(games)
privileges to write there...
Exploit attached, along with the discussion.
--
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
crawl.txt
Description: Text document
crawl.sh
Description: Bourne shell script
signature.asc
Description: Digital signature
_______________________________________________
Debian-audit mailing list
Debian-audit@xxxxxxxxxxxxx
http://shellcode.org/mailman/listinfo/debian-audit
| 
