CVE-2020-5212: NetHack MENUCOLOR configuration file option is subject to a buffer overflow
In NetHack before 3.6.5, an extremely long value for the MENUCOLOR configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nethackto a version that resolves this vulnerability.Fixed in 3.6.5
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5212?
CVE-2020-5212 has a high severity due to the potential for remote code execution and privilege escalation.
How do I fix CVE-2020-5212?
To fix CVE-2020-5212, users should update to NetHack version 3.6.5 or later.
What systems are affected by CVE-2020-5212?
CVE-2020-5212 affects systems that have NetHack installed with suid/sgid settings.
What kind of vulnerability is CVE-2020-5212?
CVE-2020-5212 is a buffer overflow vulnerability that can lead to application crashes or remote code execution.
Is CVE-2020-5212 relevant for shared systems?
Yes, CVE-2020-5212 is particularly relevant for shared systems, as it can exploit configurations that allow elevated privileges.