CVE-2000-0387 in golddig
Summary
by MITRE
The makelev program in the golddig game from the FreeBSD ports collection allows local users to overwrite arbitrary files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The CVE-2000-0387 vulnerability resides within the makelev program component of the golddig game package distributed through the FreeBSD ports collection. This particular flaw represents a classic file permission and privilege escalation issue that affects systems running FreeBSD operating systems. The vulnerability manifests when local users execute the makelev program with elevated privileges, creating a scenario where malicious actors can manipulate file system permissions and overwrite critical system files. The golddig game, designed as a simple puzzle game, includes a utility program that generates level files during gameplay, which inadvertently exposes a security weakness through improper file handling mechanisms.
The technical exploitation of this vulnerability stems from the makelev program's failure to properly validate file paths and permissions during the level generation process. When the program executes, it creates temporary files and modifies existing game data files without sufficient security checks to prevent unauthorized file system modifications. This flaw operates under the principle of insecure file handling, which falls under CWE-362, known as "Concurrent Execution using Shared Resource with Improper Synchronization." The program does not adequately verify whether the files being overwritten are system-critical or if the user has appropriate permissions to modify them, creating an opportunity for privilege escalation and potential system compromise.
From an operational impact perspective, this vulnerability allows local users to overwrite arbitrary files on the system, potentially leading to complete system compromise. Attackers can leverage this weakness to replace critical system binaries, configuration files, or other sensitive data with malicious versions, effectively enabling persistent backdoor access or system disruption. The vulnerability's local nature means that only users with existing access to the system can exploit it, but the privilege escalation potential makes it particularly dangerous in environments where users might have legitimate access to the system. This weakness directly aligns with ATT&CK technique T1068, which describes "Local Privilege Escalation" through the exploitation of system vulnerabilities, and T1078, covering "Valid Accounts" as the initial access vector.
Mitigation strategies for CVE-2000-0387 should focus on immediate patching of the affected FreeBSD ports collection package, ensuring that the makelev program properly validates file paths and implements appropriate permission checks. System administrators should also conduct comprehensive audits of all installed ports packages to identify similar vulnerabilities in other applications. The remediation process should include implementing proper file system permissions, using secure temporary file creation methods, and ensuring that programs running with elevated privileges perform thorough validation of all file system operations. Additionally, organizations should consider implementing mandatory access controls and monitoring for unauthorized file modifications to detect potential exploitation attempts. The vulnerability serves as a reminder of the importance of secure coding practices in system utilities and highlights the critical need for proper input validation and privilege management in all system components.