Description
Buffer overflow in (1) nethack 3.4.0 and earlier, and (2) falconseye 1.9.3 and earlier, which is based on nethack, allows local users to gain privileges via a long -s command line option.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nethack | 3.4.1-1 | — |
| Debian 14 | slashem | 0.0.6E4F8-6 | — |
| Debian 13 | nethack | 3.4.1-1 | — |
| Debian 13 | slashem | 0.0.6E4F8-6 | — |
| Debian 12 | nethack | 3.4.1-1 | — |
| Debian 12 | slashem | 0.0.6E4F8-6 | — |
| Debian 3.0 | falconseye | 1.9.3-7woody3 | DSA-350 |
| Debian 3.0 | jnethack | 1.1.5-11woody2 | DSA-316-3 |
| Debian 3.0 | nethack | 3.4.0-3.0woody3 | DSA-316-1 |
| Debian 3.0 | slashem | 0.0.6E4F8-4.0woody3 | DSA-316-2 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 3
- Nethack 3 - Local Buffer Overflow (1) EDB-22233 · local · Feb 10, 2003 · verified
- Nethack 3 - Local Buffer Overflow (2) EDB-22234 · local · Feb 10, 2003 · verified
- Nethack 3 - Local Buffer Overflow (3) EDB-22235 · local · Feb 10, 2003 · verified
GitHub 2 repositories
-
fengjixuchui/CVE-2003-0358 ★ 0 · Nov 22, 2023
By passing an overly large string when invoking nethack, it is possible to corrupt memory. jnethack and falconseye are also prone to this vulnerability.
-
gmh5225/CVE-2003-0358 ★ 0 · Dec 17, 2022
By passing an overly large string when invoking nethack, it is possible to corrupt memory. jnethack and falconseye are also prone to this vulnerability.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- DSA-316-3 jnethack - buffer overflow, incorrect permissions Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-316-1 nethack - buffer overflow, incorrect permissions Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-350 falconseye - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-316-2 slashem - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-350 vendor-advisory
- DSA-316 vendor-advisory
- nethack-s-command-bo(11283) vdb-entry
- 6806 vdb-entry
- 20030209 #!ICadv-02.09.03: nethack 3.4.0 local buffer overflow mailing-list
- http://nethack.sourceforge.net/v340/bugmore/secpatch.txt