PT-2020-18308 · Nethack Devteam · Nethack

Nhkeni · Published 2020-01-28 · Updated 2021-02-10 · CVE-2020-5212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetHack versions prior to 3.6.5

Description The issue is caused by an extremely long value for the MENUCOLOR configuration file option, which can result in a buffer overflow. This can lead to a crash or remote code execution/privilege escalation. It affects systems with NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files.

Recommendations For versions prior to 3.6.5, upgrade to NetHack 3.6.5 to resolve the issue. As a temporary workaround, consider restricting the ability for users to upload their own configuration files to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-5212

GHSA-G89F-M829-4M56

MGASA-2021-0077

Affected Products

Nethack

References · 25

• https://osv.dev/vulnerability/CVE-2020-5212 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-5212 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-5212 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-5212 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0077 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-5212 · Security Note
• https://advisories.mageia.org/MGASA-2021-0077.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-5212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5212 · Security Note
• https://github.com/NetHack/NetHack/security/advisories/GHSA-g89f-m829-4m56 · Note
• https://nethack.org/v364/release.html · Note
• https://nethack.org/v365/release.html · Note
• https://nethack.org/security/CVE-2019-19905.html · Note
• https://nethack.org/security/CVE-2020-5254.html · Note
• https://nethack.org/v362/release.html · Note