|
Gentoo nethack / falconseye / slashem Privilege Escalation
|
|
Secunia Advisory:
|
SA19376
|
|
|
Release Date:
|
2006-03-24
|
|
Last Update:
|
2006-03-28
|
|
Popularity:
|
8,336 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Manipulation of data
Privilege escalation
|
|
Where:
|
Local system
|
|
Solution Status:
|
Vendor Workaround
|
|
| OS: | Gentoo Linux 1.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-1390
|
|
Description:
Gentoo has reported some vulnerabilities in the nethack / falconseye / slashem packages, which can be exploited by malicious, local users to gain escalated privileges.
The vulnerabilities are caused due to NetHack, Slash'EM, and Falcon's Eye games being incompatible with the system used for managing games on Gentoo Linux. This can be exploited by a user, who is a member of the "games" group, to modify the state data, create and overwrite files, and execute arbitrary code with the permissions of other players.
The vulnerabilities have been reported in the following packages:
* games-roguelike/nethack version 3.4.3-r1 and prior.
* games-roguelike/falconseye version 1.9.4a and prior.
* games-roguelike/slashem version 0.0.760 and prior.
Solution:
The vendor recommends uninstalling the packages until a patch is available, and avoid the adding of untrusted users into the "games" group.
Provided and/or discovered by:
Reported by vendor.
Changelog:
2006-03-28: Added CVE reference.
Original Advisory:
http://www.gentoo.org/security/en/glsa/glsa-200603-23.xml
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
