CVE-2003-0359 in Nethack
Summary
by MITRE
nethack 3.4.0 and earlier installs certain setgid binaries with insecure permissions, which allows local users to gain privileges by replacing the original binaries with malicious code.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/14/2018
The vulnerability described in CVE-2003-0359 represents a critical privilege escalation flaw affecting the popular text-based adventure game nethack version 3.4.0 and earlier. This issue stems from improper permission settings on setgid binaries that are installed as part of the standard nethack package distribution. The fundamental problem occurs when the installation process fails to properly secure the setgid executables, leaving them vulnerable to modification by local users who should not possess elevated privileges.
The technical flaw manifests through insecure file permissions on setgid binaries that are designed to run with elevated privileges. In Unix-like operating systems, setgid binaries execute with the permissions of the file owner rather than the user executing them, which is typically used to provide specific privileged capabilities to applications. When these binaries are installed with world-writable permissions or other insecure configurations, local attackers can replace the original executables with malicious code. This replacement process effectively allows unprivileged users to gain elevated system privileges, as the malicious binary will execute with the elevated permissions of the setgid file owner, typically the root user or a dedicated system account.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it provides attackers with a persistent mechanism for gaining elevated access to systems running vulnerable versions of nethack. The vulnerability is particularly concerning because it leverages the legitimate installation process of a widely distributed application, making exploitation more likely and harder to detect. Attackers can exploit this weakness to execute arbitrary code with elevated privileges, potentially leading to complete system compromise, data exfiltration, or the establishment of persistent backdoors. The vulnerability affects systems where nethack is installed with default configurations, making it a widespread concern for administrators managing multiple systems.
Security professionals should address this vulnerability through immediate permission corrections on affected setgid binaries, ensuring they are properly secured with restrictive permissions that prevent unauthorized modification. The recommended mitigation involves verifying and correcting the file permissions of setgid executables to prevent world-writable or group-writable access. This vulnerability aligns with CWE-732, which describes improper permission settings on security-critical assets, and represents a classic example of insecure permissions that enable privilege escalation attacks. Organizations should implement regular security audits to identify and correct similar permission issues across their systems, as this flaw demonstrates the importance of proper file permission management in preventing unauthorized privilege escalation. The ATT&CK framework categorizes this vulnerability under privilege escalation techniques, specifically focusing on permissions-based attacks that exploit insecure file permissions to gain elevated system access.