CVE-2020-5214: NetHack error recovery after syntax error in configuration file is subject to a buffer overflow
In NetHack before 3.6.5, detecting an unknown configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NetHackto a version that resolves this vulnerability.Fixed in 3.6.5
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5214?
CVE-2020-5214 has a high severity due to its potential for buffer overflow, which can lead to remote code execution and privilege escalation.
How do I fix CVE-2020-5214?
To fix CVE-2020-5214, upgrade to NetHack version 3.6.5 or later, ensuring that the application is not running with suid/sgid privileges.
What versions of NetHack are affected by CVE-2020-5214?
NetHack versions prior to 3.6.5 are affected by CVE-2020-5214 and may be vulnerable to exploitation.
Can CVE-2020-5214 be exploited remotely?
Yes, CVE-2020-5214 can be exploited remotely, especially in shared systems that allow unrestricted user uploads.
What are the potential impacts of CVE-2020-5214?
The potential impacts of CVE-2020-5214 include application crashes, unauthorized access, and execution of arbitrary code.