CVE-2003-0359

2022-10-0316:15:44

Debian Security Bug Tracker

security-tracker.debian.org

nethack 3.4.0

setgid

binary insecurity

local privilege escalation

unix

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.1%

JSON

nethack 3.4.0 and earlier installs certain setgid binaries with insecure permissions, which allows local users to gain privileges by replacing the original binaries with malicious code.

OSVersionArchitecturePackageVersionFilename
Debian12allnethack< 3.4.1-1nethack_3.4.1-1_all.deb
Debian11allnethack< 3.4.1-1nethack_3.4.1-1_all.deb
Debian999allnethack< 3.4.1-1nethack_3.4.1-1_all.deb
Debian13allnethack< 3.4.1-1nethack_3.4.1-1_all.deb
Debian12allslashem< 0.0.6E4F8-6slashem_0.0.6E4F8-6_all.deb
Debian11allslashem< 0.0.6E4F8-6slashem_0.0.6E4F8-6_all.deb
Debian999allslashem< 0.0.6E4F8-6slashem_0.0.6E4F8-6_all.deb
Debian13allslashem< 0.0.6E4F8-6slashem_0.0.6E4F8-6_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	nethack	< 3.4.1-1	nethack_3.4.1-1_all.deb
Debian	11	all	nethack	< 3.4.1-1	nethack_3.4.1-1_all.deb
Debian	999	all	nethack	< 3.4.1-1	nethack_3.4.1-1_all.deb
Debian	13	all	nethack	< 3.4.1-1	nethack_3.4.1-1_all.deb
Debian	12	all	slashem	< 0.0.6E4F8-6	slashem_0.0.6E4F8-6_all.deb
Debian	11	all	slashem	< 0.0.6E4F8-6	slashem_0.0.6E4F8-6_all.deb
Debian	999	all	slashem	< 0.0.6E4F8-6	slashem_0.0.6E4F8-6_all.deb
Debian	13	all	slashem	< 0.0.6E4F8-6	slashem_0.0.6E4F8-6_all.deb