Symlink Vulnerability in Rocks'n'Diamonds Package Allows File Overwrite
Summary
DEBIAN-CVE-2011-4606: Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on .rocksndiamonds/cache/artworkinfo.cache under a user's home directory. Affects rocksndiamonds versions < 3.3.0.1+dfsg1-2.2. Fixed in 3.3.0.1+dfsg1-2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rocks'n'Diamonds is a popular open-source puzzle game that allows players to navigate through various levels while collecting diamonds and avoiding enemies. The game is designed to be engaging and challenging, featuring a variety of gameplay modes and levels. However, a vulnerability has been identified in version 3.3.0.1, which could allow local users to exploit the system's file handling capabilities.
Vulnerability Detail
The vulnerability identified as CVE-2011-4606 allows local users to overwrite arbitrary files through a symlink attack on the .rocksndiamonds/cache/artworkinfo.cache file located in a user's home directory. This flaw arises from inadequate validation of file paths, enabling attackers to create symbolic links that redirect file writes to unintended locations. The potential ramifications include unauthorized data modification and system compromise, particularly in multi-user environments.
How To Fix
Minimum fixed version
3.3.0.1+dfsg1-2.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rocksndiamondsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the .rocksndiamonds/cache directory by changing its permissions to prevent unauthorized users from creating symlinks. This can be done using the command: 'chmod 700 ~/.rocksndiamonds/cache'.
Conclusion
The vulnerability CVE-2011-4606 in the Rocks'n'Diamonds package poses a significant risk by allowing local users to overwrite files through symlink attacks. It is crucial for users to update to the patched version to mitigate this risk. Additionally, employing workarounds can help secure the system until an update can be applied.
See every vulnerability recorded for rocksndiamonds →
FAQ
CVE-2011-4606 is a vulnerability in the Rocks'n'Diamonds package that allows local users to overwrite arbitrary files via a symlink attack.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json to Vulert, you can check for vulnerabilities without needing to install any software.
The risks include unauthorized file modification and potential system compromise, especially in environments with multiple users.
Yes, the patched version is 3.3.0.1+dfsg1-2.2. Users should update their Rocks'n'Diamonds package to this version.
If an immediate update is not possible, consider changing the permissions of the cache directory to restrict access as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for rocksndiamonds.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
