CVE-2020-5213: NetHack SYMBOL configuration file option is subject to a buffer overflow
In NetHack before 3.6.5, too long of a value for the SYMBOL configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.5
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5213?
CVE-2020-5213 is considered a high-severity vulnerability due to its potential for remote code execution and privilege escalation.
How do I fix CVE-2020-5213?
To fix CVE-2020-5213, upgrade to NetHack version 3.6.5 or later.
What systems are affected by CVE-2020-5213?
CVE-2020-5213 affects systems that have NetHack installed with suid/sgid permissions.
Can CVE-2020-5213 lead to remote code execution?
Yes, CVE-2020-5213 can lead to remote code execution due to a buffer overflow vulnerability.
Is CVE-2020-5213 present in older versions of NetHack?
Yes, CVE-2020-5213 is present in all versions of NetHack before 3.6.5.