About Archive Tags RSS Feed


Game auditing

23 April 2005 21:50


I spent a long time yesterday downloading source code and running quick audits of them between trying to do other things.

Lots of fun, still, but nothing found.

It's frustrating sometimes seeing code which is bad but not used, because there's the knowlege that it might become live at a later date.

Here's two examples of code which isn't used:


When saving the highscore file for gtali the scorefile is saved to a temporary file, then renamed to be the real file.

The code that does this, in the setgid(games) binary looks like this:

        if (rename(tmpfile, scorefile))
                say("rename failed!");
                char scall[300];
                sprintf(scall, "mv %s %s", tmpfile, scorefile);

As no privileges are dropped the unqualified "mv" command will run with privileges setgid(games) (Indeed it must to work with /var/games, which is not writable by a typical user).

So, a trojan "mv" command will easily gain gid(games).

On none of the platforms I tested this code is used, because they all have HAVE_RENAME defined.


The following code comes from the "save game" section of the code again! It firstly makes sure that the state is saved properly.

If the magic symbol "COMPRESS_SAVE_FILES" is defined it will invoke a compression program upon the saved file, and delete the uncompressed file.

In Debian packages the compression code is disabled.

The program is setgid(games), and doesn't drop its privileges. However COMPRESSOR is defined as just "gzip", not "/bin/gzip". So gaining gid(games) is trivially possible, via a fake "gzip" binary early on your PATH.

    if (writeok &;&; compress) {
      print2("Compressing Save File....");

      strcat(temp," ");
      sprintf(temp, "%s.%s", savestr, COMPRESS_EXT);
      link(temp, savestr);
      unlink(temp);    /* renames, but sys-V doesn't have rename()... */

Pro's : The code is disabled.

Con's : Possibly upstream wasn't meant to be setgid anyway?

So, two games, two potential vulnerabilities.

| No comments