Debian: 'nethack' buffer overflow

    Date11 Jun 2003
    CategoryDebian
    3093
    Posted ByLinuxSecurity Advisories
    The nethack package is vulnerable to a buffer overflow exploited via a long '-s' command line option. This vulnerability could be used by an attacker to gain gid 'games' on a system where nethack is installed.
    
    --------------------------------------------------------------------------
    Debian Security Advisory DSA 316-1                     This email address is being protected from spambots. You need JavaScript enabled to view it.
    	 
    http://www.debian.org/security/                             Matt Zimmerman
    June 11th, 2003                          http://www.debian.org/security/faq
    --------------------------------------------------------------------------
    
    Package        : nethack
    Vulnerability  : buffer overflow, incorrect permissions
    Problem-Type   : local
    Debian-specific: no
    CVE Id         : CAN-2003-0358 CAN-2003-0359
    
    The nethack package is vulnerable to a buffer overflow exploited via a
    long '-s' command line option.  This vulnerability could be used by an
    attacker to gain gid 'games' on a system where nethack is installed.
    
    Additionally, some setgid binaries in the nethack package have
    incorrect permissions, which could allow a user who gains gid 'games'
    to replace these binaries, potentially causing other users to execute
    malicious code when they run nethack.
    
    For the stable distribution (woody) these problems have been fixed in
    version 3.4.0-3.0woody3.
    
    For the old stable distribution (potato) problem xxx has been fixed in
    version 3.3.0-7potato1.
    
    For the unstable distribution (sid) these problems are fixed in
    version 3.4.1-1.
    
    We recommend that you update your nethack package.
    
    Upgrade Instructions
    --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    Debian GNU/Linux 2.2 alias potato
    ---------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1.dsc
          Size/MD5 checksum:      655 6457b20023bb6993cf7b67eb3d6a1f92
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1.diff.gz
          Size/MD5 checksum:    18692 13ac890591e25dab8ceed16f72e1f471
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0.orig.tar.gz
          Size/MD5 checksum:  2887417 cf9f4039408321f39c3ef733455cb73a
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1_alpha.deb
          Size/MD5 checksum:  1398066 713fcbb55b30327e41e27d6bcb6d607b
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1_arm.deb
          Size/MD5 checksum:  1117428 73c2db664578473ef6659cab5cc4d6ef
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1_i386.deb
          Size/MD5 checksum:  1022056 db40676e291e8df8a4e361bcbfffe7bf
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1_m68k.deb
          Size/MD5 checksum:   978610 2b11d697920115da6d6221ff0a561c28
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1_powerpc.deb
          Size/MD5 checksum:  1128166 97049fd8d1f264630e8388646f5b35e0
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.3.0-7potato1_sparc.deb
          Size/MD5 checksum:  1148254 a4ca25a566409ce3ff5bb84dc68b7b15
    
    Debian GNU/Linux 3.0 alias woody
    --------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.4.0-3.0woody3.dsc
          Size/MD5 checksum:      748 3b19c11e859addf7387327edc9919dda
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.4.0-3.0woody3.diff.gz
          Size/MD5 checksum:    67431 178cb16dc35eba59d3f2cb8d9bcc82c9
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.4.0.orig.tar.gz
          Size/MD5 checksum:  3270905 0093f14fbbe449d5b188bfb6aa4eae4f
    
      Architecture independent components:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack_3.4.0-3.0woody3_all.deb
          Size/MD5 checksum:    12996 adc0f1e825fbaf6d051ebe9ce6d113fd
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_alpha.deb
          Size/MD5 checksum:   448546 e22a529c9f6dd56f754e65c143e888bf
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_alpha.deb
          Size/MD5 checksum:  1159370 7cb61bf9e18ab76ea49e8f5d07789b86
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_alpha.deb
          Size/MD5 checksum:  1166088 9a04f218f4f12986991f231f32d78657
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_alpha.deb
          Size/MD5 checksum:  1099536 4ade2cb58891fbf4612861e621de668a
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_arm.deb
          Size/MD5 checksum:   430974 73bb44aa965b99c8dc95dab7789aba7b
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_arm.deb
          Size/MD5 checksum:   891296 68a140761542ca2047adfd77ccee72c9
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_arm.deb
          Size/MD5 checksum:   908178 b5c7b5764ff27dffa7228848cacbf7c6
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_arm.deb
          Size/MD5 checksum:   826270 9090d14c531d1d6cd5ec555742aa39dc
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_i386.deb
          Size/MD5 checksum:   427996 cbd2cccef376e1986d3d30489ef41f46
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_i386.deb
          Size/MD5 checksum:   790660 6fc1683852e67991d7b8326313d3dada
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_i386.deb
          Size/MD5 checksum:   812066 bd0720e9b7ff4394388557628a782552
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_i386.deb
          Size/MD5 checksum:   722422 3e25c8e6abe0da37c38b18819ba41231
    
      HP Precision architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_hppa.deb
          Size/MD5 checksum:   437252 4814c05bfe6becaa61d765c5e16d960b
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_hppa.deb
          Size/MD5 checksum:  1028208 f3786ca02d6e4a2addc838713c72b541
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_hppa.deb
          Size/MD5 checksum:  1050072 a7e2a4df3d68b695a8f115a07d02745c
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_hppa.deb
          Size/MD5 checksum:   964926 c52414ef50a612a375c50f62f32a9910
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_m68k.deb
          Size/MD5 checksum:   425090 d6f27579b87dc04bbdf3027e03d31c21
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_m68k.deb
          Size/MD5 checksum:   744130 6c9d59e42180972c686e9588c34a0dc3
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_m68k.deb
          Size/MD5 checksum:   759848 25f8e9bf0bfc3bb214cf44aa53551bb7
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_m68k.deb
          Size/MD5 checksum:   677096 1a8fee87a24e387b4cccc82047f56154
    
      Big endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_mips.deb
          Size/MD5 checksum:   437234 285bc9f5ecf31dc795b36d6d3938c198
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_mips.deb
          Size/MD5 checksum:   913234 8307a4a58da664337ffea071f9cfedb3
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_mips.deb
          Size/MD5 checksum:   962694 1f2157ea26bb522e53acadc8474c4b3b
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_mips.deb
          Size/MD5 checksum:   884232 d10f2486bdd53389c34be664fbbebf62
    
      Little endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_mipsel.deb
          Size/MD5 checksum:   436524 df00a3c0227ddeeb6784b40098be977e
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_mipsel.deb
          Size/MD5 checksum:   915438 1d4751a80d3a3b7c1856d3c11e3c42be
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_mipsel.deb
          Size/MD5 checksum:   960486 6eca0d12e7dcb0c2b048074897ce0633
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_mipsel.deb
          Size/MD5 checksum:   885692 ab561bd3c0d59511cd64bb562504d32a
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_powerpc.deb
          Size/MD5 checksum:   433282 44392c68c6c4642d13a8477e43888edc
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_powerpc.deb
          Size/MD5 checksum:   894054 8caa102c4fc9eaebe14b07573c64e8d6
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_powerpc.deb
          Size/MD5 checksum:   895404 a23e819c3810747f7133e7716a4c67f1
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_powerpc.deb
          Size/MD5 checksum:   829348 9ac4bfbec280ba184f53ea25a985423d
    
      IBM S/390 architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_s390.deb
          Size/MD5 checksum:   431388 184539e76b551bf4fc906f1b79a582cf
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_s390.deb
          Size/MD5 checksum:   872456 9e731f496af24534688fae59e7f24045
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_s390.deb
          Size/MD5 checksum:   876436 7de38b1345a4a25a875ee8126a4f4200
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_s390.deb
          Size/MD5 checksum:   807628 d2388393e737ac21317a3e559566ec0d
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/n/nethack/nethack-common_3.4.0-3.0woody3_sparc.deb
          Size/MD5 checksum:   440772 ef35b8dc5cc1abbb0276d724656f68c8
         http://security.debian.org/pool/updates/main/n/nethack/nethack-gnome_3.4.0-3.0woody3_sparc.deb
          Size/MD5 checksum:   911986 0b2eee94e97f64b49f2cd3ff072dc2fa
         http://security.debian.org/pool/updates/main/n/nethack/nethack-qt_3.4.0-3.0woody3_sparc.deb
          Size/MD5 checksum:   912976 b690faf77cd6a932200779ca36763c95
         http://security.debian.org/pool/updates/main/n/nethack/nethack-x11_3.4.0-3.0woody3_sparc.deb
          Size/MD5 checksum:   847972 3668f6f14f7924b1446fad9591bd1abb
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    ---------------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"37","type":"x","order":"1","pct":51.39,"resources":[]},{"id":"88","title":"Should be more technical","votes":"10","type":"x","order":"2","pct":13.89,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"25","type":"x","order":"3","pct":34.72,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.