🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: net.games.hack
Article #560

security

#560
From: Andries Brouwer
Date: Thu, 09 May 1985 04:55
15 lines
1353 bytes
As Dhutchin@cs.ucl.AC.UK pointed out hack contains the following
security bug. At the start of a game a file is created with as
filename the loginname of the player. If he is called 'data' or
'rumors' or 'hack' then you are in trouble.
In fact it is even worse. One of the options allows you to
choose your playing name, and one might choose '../../something'
as name, and destroy whatever hack has write access to.

The fix is easy and obvious, but since this happens in a place
in the source where my current version is rather different from
the distributed one I'd rather wait till the next release.
If you are really concerned (You occupy the first place on the
list of topscorers and are afraid that one of your students
might blow away the score file) then ask for the diffs. When
enough people ask I'll post them.
Technical Details
Message-ID: <660@mcvax.UUCP>
Path: arc1-ca.pugleaf.net!utzoo!linus!philabs!cmcl2!seismo!mcvax!aeb

Show Full Headers
Complete Article Headers
Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.1 6/24/83 (MC840302); site mcvax.UUCP
Path: arc1-ca.pugleaf.net!utzoo!linus!philabs!cmcl2!seismo!mcvax!aeb
From: aeb@mcvax.UUCP (Andries Brouwer)
Newsgroups: net.games.hack
Subject: security
Message-ID: <660@mcvax.UUCP>
Date: Thu, 9-May-85 00:55:17 EDT
Article-I.D.: mcvax.660
Posted: Thu May  9 00:55:17 1985
Date-Received: Sat, 11-May-85 07:38:42 EDT
Reply-To: aeb@mcvax.UUCP (Andries Brouwer)
Organization: CWI, Amsterdam
Lines: 15