PT-2006-2399 · Nethack+2 · Nethack+2

Tavis Ormandy · Published 2006-03-25 · Updated 2018-10-18 · CVE-2006-1390

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetHack versions 3.4.3-r1 and earlier Falcon's Eye versions 1.9.4a and earlier Slash'EM versions 0.0.760 and earlier

Description The issue allows local users in the games group to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks by modifying saved games files.

Recommendations For NetHack versions 3.4.3-r1 and earlier, consider restricting access to saved games files to prevent modification. For Falcon's Eye versions 1.9.4a and earlier, restrict write access to sensitive files that could be overwritten via symlink attacks. For Slash'EM versions 0.0.760 and earlier, limit the ability of local users in the games group to modify saved games files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-1390

Affected Products

Falconseye

Nethack

Slash'Em

References · 12

• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=122376 · Exploit
• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=125902 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1390 · Security Note
• http://secunia.com/advisories/19376 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200603-23.xml · Patch, Vendor Advisory
• http://bugs.gentoo.org/show_bug.cgi?id=127319 · Note
• http://securityfocus.com/archive/1/428743/100/0/threaded · Note
• http://osvdb.org/24104 · Note
• http://securityfocus.com/archive/1/428739/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25528 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=127167 · Note
• http://securityfocus.com/bid/17217 · Note