Rogue 5.3 - Local Buffer Overflow

source: https://www.securityfocus.com/bid/5837/info

Rogue is a game included with BSD distributions including FreeBSD and NetBSD.

By passing an overly long value when restoring a saved game, it is possible for an attacker to corrupt memory. Exploitation of this issue could result in privilege escalation to the 'games' group, further resulting in the corruption of saved game data, as well as storage consumption.

--- myng/dev/myarticles.php.old	Fri Sep 27 00:00:58 2002
+++ myng/dev/myarticles.php	Fri Sep 27 00:01:24 2002
@@ -126,7 +126,7 @@
                 $t->set_var("date",$date);
                 $t->set_var("id_article",$db->Record['id_article']);
                 $t->set_var("sender",$db2->Record['name']);
-                $t->set_var("subject",$db2->Record['subject']);
+                $t->set_var("subject",htmlspecialchars($db2->Record['subject']));

                 $group_url = "tree.php?group_name=".rawurlencode(real2table($db->Record['group_name']))."&begin=0&server=".rawurlencode($db->Record['server']);
                 $t->set_var("group_url",$group_url);
--- myng/dev/search.php.old	Fri Sep 27 00:03:14 2002
+++ myng/dev/search.php	Fri Sep 27 00:03:56 2002
@@ -97,7 +97,7 @@
                         $t->set_var("date",$date);
                         $article_url = "article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$db->Record['newsgroup'];
                         $t->set_var("article_url",$article_url);
-                        $t->set_var("subject",$db->Record['subject']);
+                        $t->set_var("subject",htmlspecialchars($db->Record['subject']));
                         $t->set_var("sender",$db->Record['name']);
                         $t->set_var("group",$db->Record['newsgroup']);
                         $t->set_var("readings",$db->Record['num_readings']);
@@ -173,7 +173,7 @@
                                 $t->set_var("date",$date);
                                 $article_url = "article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$db->Record['newsgroup'];
                                 $t->set_var("article_url",$article_url);
-                                $t->set_var("subject",$db->Record['subject']);
+                                $t->set_var("subject",htmlspecialchars($db->Record['subject']));
                                 $t->set_var("sender",$db->Record['name']);
                                 $t->set_var("group",$db->Record['newsgroup']);
                                 $t->set_var("readings",$db->Record['num_readings']);
--- myng/dev/stats.php.old	Fri Sep 27 00:05:14 2002
+++ myng/dev/stats.php	Fri Sep 27 00:06:40 2002
@@ -205,7 +205,7 @@
         while($db2->next_record()){

                 $num_replies[$j][0] = $db2->Record[1];
-                $num_replies[$j][1] = $db2->Record['subject'];
+                $num_replies[$j][1] = htmlspecialchars($db2->Record['subject']);
                 $j ++;

         }
@@ -246,7 +246,7 @@
         $db2->query($consulta2);
         while($db2->next_record()){
                 $num_readings[$j][0] = $db2->Record['num_readings'];
-                $num_readings[$j][1] = $db2->Record['subject'];
+                $num_readings[$j][1] = htmlspecialchars($db2->Record['subject']);
                 $j ++;
         }

--- myng/dev/lib/standard.lib.php.old	Thu Sep 26 23:54:04 2002
+++ myng/dev/lib/standard.lib.php	Thu Sep 26 23:58:13 2002
@@ -577,7 +577,7 @@

                         $li_image = "li".$li_number.$color.".gif";

-                        $linea2 = $linea."<img src=images/".$li_image." width=5 height=5>&nbsp;"."<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".rawurlencode($group_name).">".$db->Record['subject']."</a>";
+                        $linea2 = $linea."<img src=images/".$li_image." width=5 height=5>&nbsp;"."<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".rawurlencode($group_name).">".htmlspecialchars($db->Record['subject'])."</a>";

                         $reply_url = "post.php?type=reply&id=".$db->Record['number']."&group=".$group_name;
                         //echo $reply_url;
@@ -674,7 +674,7 @@
         $db->query($consulta);
         $db->next_record();

-        $url_subject = "<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$group_name.">".$db->Record['subject']."</a>";
+        $url_subject = "<a class=text href=article.php?id_article=".rawurlencode($db->Record['id'])."&group_name=".$group_name.">".htmlspecialchars($db->Record['subject'])."</a>";
         $t->set_var("p_subject",$url_subject);
         $c->username = $db->Record['username'];
         $c->email = $db->Record['from_header'];