SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Game)  >   Abuse Vendors:   Clark, Jonathan
Abuse Video Game Buffer Overflow Allows Local Users to Gain Root Privileges
SecurityTracker Alert ID:  1005522
SecurityTracker URL:  http://securitytracker.com/id/1005522
CVE Reference:   CVE-2002-1250   (Links to External Site)
Date:  Nov 3 2002
Impact:   Execution of arbitrary code via local system, Root access via local system
Vendor Confirmed:  Yes  
Version(s): 2.00
Description:   A buffer overflow is reported in the Abuse game software. A local user can obtain root privileges on the system.

iDEFENSE reported that a local user could supply a long '-net' command line argument to trigger the overflow and execute arbitrary code. According to the report, both abuse.console and abuse.x11R6 are vulnerable in the default installation of Debian Linux. Both files are configured with set group id (setgid) 'games' privileges and abuse.console is configured with set user id (setuid) 'root' privileges. Because of this, the local user's arbitrary code may be executed with root level privileges.

Other operating systems may also be affected (not just Debian).

A demonstration exploit command line is provided:

$ /usr/lib/games/abuse/abuse.console -net 'perl -e 'print "A"x500''

Impact:   A local user may be able to execute arbitrary code with root privileges to gain root access on the system.
Solution:   No solution was available at the time of this entry. However, iDEFENSE has provided the following workarounds:

1. Remove Abuse by issuing the following command:

# apt-get remove abuse

2. Remove the setuid bit from the XaoS binary by executing the following command:

# chmod -s /usr/lib/games/abuse/abuse.*

According to the report, the vendor has responded that Abuse has a several other vulnerabilities and should not be installed on a multi-user system where security is a concern. For example, Abuse reportedly allows a local user to specify at startup via command line parameters that alternate Lisp script files be executed. Some script functions may be able to execute abritrary commands or modify files with root privileges.

Vendor URL:  abuse2.com/downloads.php3 (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability in Abuse


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

iDEFENSE Security Advisory 11.01.02: 
http://www.idefense.com/advisory/11.01.02.txt
Buffer Overflow Vulnerability in Abuse
October 31, 2002

I. BACKGROUND

Abuse is a popular side-scrolling video game. More information can be
found at http://jonathanclark.com/ and http://www.crack.com/.

II. DESCRIPTION

Exploitation of a locally exploitable parsing error in Abuse's "-net"
command line option could allow attackers to gain root privileges on
a targeted system. By supplying an overly long argument, the
instruction pointer is overwritten, thereby allowing an attacker to
seize control of the executable. In a default abuse installation in
Debian Linux, both abuse.console and abuse.x11R6 can be used in
exploitation; both files are set group id games, and abuse.console is
set user id root.

III. ANALYSIS

Exploitation allows a local attacker to gain super-user status and
full control over the targeted system. Affected users should
implement either of the two workarounds listed below.

IV. DETECTION

Abuse 2.00, which is packaged and distributed with the x86
architecture of Debian Linux 3.0r0, is vulnerable. Other platforms
and architectures may be vulnerable as well. To determine if a
specific Abuse implementation is vulnerable, launch it with the
following command line:

$ /usr/lib/games/abuse/abuse.console -net 'perl -e 'print "A"x500''

If the application crashes with a "Segmentation fault", it is
vulnerable.

V. WORKAROUND

Customers should consider implementing one of the two following
workarounds:

1. Remove Abuse by issuing the following command:

# apt-get remove abuse 

2. Remove the setuid bit from the XaoS binary by executing the
following command:

# chmod -s /usr/lib/games/abuse/abuse.*

VI. VENDOR RESPONSE

"Abuse has a number of other vulnerabilities and should never be
installed on a multi-user system where security is a concern," said
Jonathan Clark.

"Abuse allows alternate Lisp script files to be executed at startup
via command line parameters.  Some script functions can execute
abritrary commands or cause external files to modified."

VII. CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
assigned the identification number CAN-2002-1250 to this issue.

VIII. DISCLOSURE TIMELINE

10/15/2002	Issue disclosed to iDEFENSE
10/31/2002	Author notified
10/31/2002	iDEFENSE clients notified
11/01/2002	Response received from Jonathan Clark 
		(jc@jonathanclark.com)
11/01/2002	Public disclosure

IX. CREDIT

Texonet (http://www.texonet.com) discovered this vulnerability.


Get paid for security research
http://www.idefense.com/contributor.html

Subscribe to iDEFENSE Advisories:
send email to listserv@idefense.com, subject line: "subscribe"


About iDEFENSE:

iDEFENSE is a global security intelligence company that proactively
vulnerabilities and hacker profiling to the global spread of viruses
and other malicious code. Our security intelligence services provide 
decision-makers, frontline security professionals and network 
administrators with timely access to actionable intelligence
and decision support on cyber-related threats. For more information,
visit http://www.idefense.com.


- -dave

David Endler, CISSP
Director, Technical Intelligence
iDEFENSE, Inc.
14151 Newbrook Drive
Suite 100
Chantilly, VA 20151
voice: 703-344-2632
fax: 703-961-1071

dendler@idefense.com
www.idefense.com

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1.2
Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4B0ACC2A

iQA/AwUBPcLJckrdNYRLCswqEQKiIwCfYNMqgc3cz0u47KI072fQTtGqTN4An064
DlkW88VtmsQ+ZCyPWhAWnRms
=tjox
-----END PGP SIGNATURE-----


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC