> Virtually any program using the GNOME libraries is vulnerable to a
> buffer overflow attack. The attack comes in the form:
>
> /path/to/gnome/prog --enable-sound --espeaker=$80bytebuffer
I can duplicate this for gnome-libs 1.0.8 but not with gnome-libs 1.0.15
> tried it on (the irony) /usr/games/nethack, which is SGID root by default
> on RH6.0. An attack on any program will look something like this:
Red Hat 6.0 doesn't include nethack. It is shipped on "Power Tools" but not
a Gnome version.
Some 6.0 games are setgid "games". I'm not sure it will give a setgid shell on
those because the gnome games wrapper is at least intended to drop privs
before the program does anything. It may do.
> Linux Mandrake release 6.0 (Venus)
Mandrake != Red Hat
not remotely.
Alan
