GLSA 200603-23: NetHack, Slash'EM, Falcon's Eye: Local privilege escalation

http://security.gentoo.org/

Опасность:	средняя
Заголовок:	NetHack, Slash'EM, Falcon's Eye: Local privilege escalation
Дата:	23.03.2006
Ошибки:	#125902, #122376, #127167, #127319
ID:	200603-23

Сводка

NetHack, Slash'EM and Falcon's Eye are vulnerable to local privilege escalation vulnerabilities that could potentially allow the execution of arbitrary code as other users.

Назначение

NetHack is the classic single player dungeon exploration game. Slash'EM and Falcon's Eye are NetHack variants.

Уязвимые пакеты

Пакет	Уязвимый	Архитектура(ы)
games-roguelike/nethack	<= 3.4.3-r1	All supported architectures
games-roguelike/falconseye	<= 1.9.4a	All supported architectures
games-roguelike/slashem	<= 0.0.760	All supported architectures

Описание

NetHack, Slash'EM and Falcon's Eye have been found to be incompatible with the system used for managing games on Gentoo Linux. As a result, they cannot be played securely on systems with multiple users.

Воздействие

A local user who is a member of group "games" may be able to modify the state data used by NetHack, Slash'EM or Falcon's Eye to trigger the execution of arbitrary code with the privileges of other players. Additionally, the games may create save game files in a manner not suitable for use on Gentoo Linux, potentially allowing a local user to create or overwrite files with the permissions of other players.

Обход

Do not add untrusted users to the "games" group.

Решение

NetHack has been masked in Portage pending the resolution of these issues. Vulnerable NetHack users are advised to uninstall the package until further notice.

    # emerge --ask --verbose --unmerge "games-roguelike/nethack"

Slash'EM has been masked in Portage pending the resolution of these issues. Vulnerable Slash'EM users are advised to uninstall the package until further notice.


    # emerge --ask --verbose --unmerge "games-roguelike/slashem"

Falcon's Eye has been masked in Portage pending the resolution of these issues. Vulnerable Falcon's Eye users are advised to uninstall the package until further notice.


    # emerge --ask --verbose --unmerge "games-roguelike/falconseye"

Ссылки

CVE-2006-1390

Наличие

Этот GLSA и любые обновления для нее доступны для просмотра на сайте Gentoo Security: http://security.gentoo.org/glsa/glsa-200603-23.xml

Опасения?

Безопасность является одной из главных задач Gentoo Linux и первостепенное значение обеспечить конфиденциальность и безопасность машин наших пользователей. Любые соображения безопасности должны быть адресованы security@gentoo.org или в качестве альтернативы, вы можете сообщить об ошибке на https://bugs.gentoo.org.