NetHack, Slash'EM, Falcon's Eye: Local privilege escalation

Security Team  Contact Address

Updated March 23, 2006

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200603-23 / nethack slashem falconseye
Release Date March 23, 2006
Latest Revision March 30, 2006: 01
Impact normal
Exploitable local
Package Vulnerable versions Unaffected versions Architecture(s)
games-roguelike/nethack <= 3.4.3-r1 All supported architectures
games-roguelike/falconseye <= 1.9.4a All supported architectures
games-roguelike/slashem <= 0.0.760 All supported architectures

Related bugreports: #125902, #122376, #127167, #127319

Synopsis

NetHack, Slash'EM and Falcon's Eye are vulnerable to local privilege escalation vulnerabilities that could potentially allow the execution of arbitrary code as other users.

2.  Impact Information

Background

NetHack is the classic single player dungeon exploration game. Slash'EM and Falcon's Eye are NetHack variants.

Description

NetHack, Slash'EM and Falcon's Eye have been found to be incompatible with the system used for managing games on Gentoo Linux. As a result, they cannot be played securely on systems with multiple users.

Impact

A local user who is a member of group "games" may be able to modify the state data used by NetHack, Slash'EM or Falcon's Eye to trigger the execution of arbitrary code with the privileges of other players. Additionally, the games may create save game files in a manner not suitable for use on Gentoo Linux, potentially allowing a local user to create or overwrite files with the permissions of other players.

3.  Resolution Information

Workaround

Do not add untrusted users to the "games" group.

Resolution

NetHack has been masked in Portage pending the resolution of these issues. Vulnerable NetHack users are advised to uninstall the package until further notice.

Code Listing 3.1: Resolution

# emerge --ask --verbose --unmerge "games-roguelike/nethack"

Slash'EM has been masked in Portage pending the resolution of these issues. Vulnerable Slash'EM users are advised to uninstall the package until further notice.

Code Listing 3.2: Resolution

# emerge --ask --verbose --unmerge "games-roguelike/slashem"

Falcon's Eye has been masked in Portage pending the resolution of these issues. Vulnerable Falcon's Eye users are advised to uninstall the package until further notice.

Code Listing 3.3: Resolution

# emerge --ask --verbose --unmerge "games-roguelike/falconseye"

4.  References