> Virtually any program using the GNOME libraries is vulnerable to a > buffer overflow attack. The attack comes in the form: > > /path/to/gnome/prog --enable-sound --espeaker=$80bytebuffer I can duplicate this for gnome-libs 1.0.8 but not with gnome-libs 1.0.15 > tried it on (the irony) /usr/games/nethack, which is SGID root by default > on RH6.0. An attack on any program will look something like this: Red Hat 6.0 doesn't include nethack. It is shipped on "Power Tools" but not a Gnome version. Some 6.0 games are setgid "games". I'm not sure it will give a setgid shell on those because the gnome games wrapper is at least intended to drop privs before the program does anything. It may do. > Linux Mandrake release 6.0 (Venus) Mandrake != Red Hat not remotely. Alan
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:05:31 PDT