CVE-2020-5210 - NetHack command line -w option parsing is subject to a buffer overflow

Back Back to CVE browser

HIGH

NetHack command line -w option parsing is subject to a buffer overflow

Published Jan 28, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.80%

Description

In NetHack before 3.6.5, an invalid argument to the -w command line option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.

Affected products

Vendor NetHack Product NetHack Default
n/a
- Version
  < 3.6.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NetHack

n/a

Version	Status	Constraints
< 3.6.5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26450
Advisory
https://github.com/NetHack/NetHack/commit/f3def5c0b999478da2d0a8f0b6a7c370a2065f77
x_refsource_MISCPatch
https://github.com/NetHack/NetHack/security/advisories/GHSA-v5pg-hpjg-9rpp
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26450		Advisory
https://github.com/NetHack/NetHack/commit/f3def5c0b999478da2d0a8f0b6a7c370a2065f77		x_refsource_MISCPatch
https://github.com/NetHack/NetHack/security/advisories/GHSA-v5pg-hpjg-9rpp		x_refsource_CONFIRMThird Party Advisory