PT-2003-1560 · Falcon'S Eye Dev Team+1 · Falconseye+1

Published 2003-05-30 · Updated 2020-12-09 · CVE-2003-0358

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: nethack versions 3.4.0 and earlier falconseye versions 1.9.3 and earlier

Description: The issue allows local users to gain privileges via a long -s command line option, which leads to a buffer overflow. This affects both nethack and falconseye, with the latter being based on nethack.

Recommendations: For nethack versions 3.4.0 and earlier, consider restricting the use of the -s command line option until a patch is available. For falconseye versions 1.9.3 and earlier, avoid using the -s command line option in conjunction with long inputs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2003-0358

DSA-316

DSA-350

Affected Products

Falconseye

Nethack

References · 15

• 🔥 https://github.com/snowcra5h/CVE-2003-0358 · Exploit
• 🔥 https://exploit-db.com/exploits/22235 · Exploit
• 🔥 https://exploit-db.com/exploits/22233 · Exploit
• 🔥 https://exploit-db.com/exploits/22234 · Exploit
• 🔥 http://securityfocus.com/archive/1/311172/2003-02-08/2003-02-14/0 · Exploit
• https://osv.dev/vulnerability/CVE-2003-0358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0358 · Security Note
• http://debian.org/security/2003/dsa-316 · Vendor Advisory
• http://nethack.sourceforge.net/v340/bugmore/secpatch.txt · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0358 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0358 · Vendor Advisory
• http://debian.org/security/2003/dsa-350 · Vendor Advisory
• https://t.me/cvenotify/6833 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11283 · Note
• http://securityfocus.com/bid/6806 · Note