[ GLSA 200603-26 ] bsd-games: Local privilege escalation in tetris-bsd

[Stefan Cornelius <dercorny () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200603-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: bsd-games: Local privilege escalation in tetris-bsd
      Date: March 29, 2006
      Bugs: #122399
        ID: 200603-26

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

tetris-bsd is prone to local privilege escalation vulnerabilities.

Background
==========

bsd-games is a collection of NetBSD games ported to Linux.

Affected packages
=================

    -------------------------------------------------------------------
     Package               /  Vulnerable  /                 Unaffected
    -------------------------------------------------------------------
  1  games-misc/bsd-games      < 2.17-r1                    >= 2.17-r1

Description
===========

Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that
the checkscores() function in scores.c reads in the data from the
/var/games/tetris-bsd.scores file without validation, rendering it
vulnerable to buffer overflows and incompatible with the system used
for managing games on Gentoo Linux. As a result, it cannot be played
securely on systems with multiple users. Please note that this is
probably a Gentoo-specific issue.

Impact
======

A local user who is a member of group "games" may be able to modify the
tetris-bsd.scores file to trigger the execution of arbitrary code with
the privileges of other players.

Workaround
==========

Do not add untrusted users to the "games" group.

Resolution
==========

All bsd-games users are advised to update to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=games-misc/bsd-games-2.17-r1"

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200603-26.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/