Symlink Attack Vulnerability in Rocks'n'Diamonds Package
Summary
CVE-2011-4606: Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on .rocksndiamonds/cache/artworkinfo.cache under a user's home directory. Affects rocksndiamonds versions < 3.3.0.1+dfsg1-2.2. Fixed in 3.3.0.1+dfsg1-2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rocks'n'Diamonds is a classic puzzle game that allows players to navigate through various levels while collecting diamonds and avoiding obstacles. The game is popular in the open-source community and is available on multiple platforms. However, a vulnerability has been identified in version 3.3.0.1, which allows local users to exploit symlink attacks, potentially leading to unauthorized file overwrites.
Vulnerability Detail
The vulnerability, identified as CVE-2011-4606, arises from the improper handling of symlinks in the Rocks'n'Diamonds package. Specifically, the application allows local users to create symbolic links to arbitrary files, which can lead to overwriting sensitive files in the user's home directory. This could result in data loss or unauthorized access to critical information, making it a significant security concern for users of the game.
How To Fix
Minimum fixed version
3.3.0.1+dfsg1-2.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rocksndiamondsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the .rocksndiamonds/cache/artworkinfo.cache file by changing its permissions to prevent unauthorized users from creating symlinks. This can be done with the following command:
chmod 600 ~/.rocksndiamonds/cache/artworkinfo.cache
Conclusion
The CVE-2011-4606 vulnerability in the Rocks'n'Diamonds package poses a significant risk due to its potential for file overwrites via symlink attacks. Users are strongly advised to update their software to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for rocksndiamonds →
FAQ
CVE-2011-4606 is a vulnerability in the Rocks'n'Diamonds package that allows local users to overwrite arbitrary files via a symlink attack.
You can check your version of Rocks'n'Diamonds by running 'rocksndiamonds --version' in your terminal. If it is below 3.3.0.1+dfsg1-2.2, it is affected.
The risks include unauthorized file access, data loss, and potential exploitation of sensitive information stored in the user's home directory.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
More information can be found on the official CVE database or by visiting the Vulert website, which provides tools for vulnerability monitoring.
Related vulnerabilities
Recent vulnerabilities recorded for rocksndiamonds.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.