NetHack / JNetHack Incorrect Permissions Vulnerability

Bugtraq ID:	7953
Class:	Configuration Error
CVE:	CVE-2003-0359
Remote:	No
Local:	Yes
Published:	Jun 12 2003 12:00AM
Updated:	Jul 11 2009 10:06PM
Credit:	This vulnerability was announced in a Debian advisory.
Vulnerable:	Nethack Nethack 3.4 .0 - Debian Linux 3.0 sparc - Debian Linux 3.0 s/390 - Debian Linux 3.0 ppc - Debian Linux 3.0 mipsel - Debian Linux 3.0 mips - Debian Linux 3.0 m68k - Debian Linux 3.0 ia-64 - Debian Linux 3.0 ia-32 - Debian Linux 3.0 hppa - Debian Linux 3.0 arm - Debian Linux 3.0 alpha - Debian Linux 3.0 Nethack Nethack 3.3 .0 - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 IA-32 - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - Debian Linux 2.2 jnethack jnethack 1.1.5 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 jnethack jnethack 1.1.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2
Not Vulnerable:

NetHack / JNetHack Incorrect Permissions Vulnerability

It has been reported that Nethack is configured incorrectly with weak default permissions.

The precise technical nature of this vulnerability is currently unknown. This BID will be updated as further information becomes available.

NetHack / JNetHack Incorrect Permissions Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

NetHack / JNetHack Incorrect Permissions Vulnerability

Solution:
Debian has released an advisory (DSA 316-1) that addresses this issue. Please see the attached Debian advisory for details on applying and obtaining fixes.

Fixes available:


jnethack jnethack 1.1.3

• Debian jnethack_1.1.3-4potato1_alpha.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.3 -4potato1_alpha.deb


• Debian jnethack_1.1.3-4potato1_arm.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.3 -4potato1_arm.deb


• Debian jnethack_1.1.3-4potato1_i386.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.3 -4potato1_i386.deb


• Debian jnethack_1.1.3-4potato1_m68k.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.3 -4potato1_m68k.deb


• Debian jnethack_1.1.3-4potato1_powerpc.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.3 -4potato1_powerpc.deb


• Debian jnethack_1.1.3-4potato1_sparc.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.3 -4potato1_sparc.deb

jnethack jnethack 1.1.5

• Debian jjnethack_1.1.5-11woody2_mipsel.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_mipsel.deb


• Debian jnethack_1.1.5-11woody2_alpha.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_alpha.deb


• Debian jnethack_1.1.5-11woody2_arm.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_arm.deb


• Debian jnethack_1.1.5-11woody2_hppa.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_hppa.deb


• Debian jnethack_1.1.5-11woody2_i386.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_i386.deb


• Debian jnethack_1.1.5-11woody2_ia64.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_ia64.deb


• Debian jnethack_1.1.5-11woody2_m68k.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_m68k.deb


• Debian jnethack_1.1.5-11woody2_mips.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_mips.deb


• Debian jnethack_1.1.5-11woody2_powerpc.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_powerpc.deb


• Debian jnethack_1.1.5-11woody2_s390.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_s390.deb


• Debian jnethack_1.1.5-11woody2_sparc.deb
  http://security.debian.org/pool/updates/main/j/jnethack/jnethack_1.1.5 -11woody2_sparc.deb

NetHack / JNetHack Incorrect Permissions Vulnerability

References: