PT-2020-18310 · Nethack · Nethack

Nhkeni · Published 2020-01-28 · Updated 2021-02-10 · CVE-2020-5214

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NetHack versions prior to 3.6.5

Description The issue is caused by detecting an unknown configuration file option, which can result in a buffer overflow. This can lead to a crash or remote code execution/privilege escalation. It affects systems with NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files.

Recommendations For versions prior to 3.6.5, upgrade to NetHack 3.6.5 to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-5214

GHSA-P8FW-RQ89-XQX6

MGASA-2021-0077

Affected Products

Nethack

References · 25

• https://security-tracker.debian.org/tracker/CVE-2020-5214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5214 · Security Note
• https://ubuntu.com/security/CVE-2020-5214 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0077 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-5214 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5214 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-5214 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0077.html · Security Note
• https://cve.org/CVERecord?id=CVE-2020-5214 · Security Note
• https://github.com/NetHack/NetHack/security/advisories/GHSA-p8fw-rq89-xqx6 · Note
• https://nethack.org/v364/release.html · Note
• https://nethack.org/v365/release.html · Note
• https://nethack.org/security/CVE-2019-19905.html · Note
• https://nethack.org/security/CVE-2020-5254.html · Note
• https://nethack.org/v362/release.html · Note