(SCO Issues Fix for OpenLinux) GNU Screen Integer Overflow in 'ansi.c' May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1009320 |
|
SecurityTracker URL: http://securitytracker.com/id/1009320
|
|
CVE Reference:
CAN-2003-0972
(Links to External Site)
|
Date: Mar 5 2004
|
Impact:
Execution of arbitrary code via local system, Root access via local system, User access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 4.0.1, 3.9.15, and prior versions
|
Description:
A vulnerability was reported in GNU Screen. A local user may be able to execute arbitrary code to gain elevated privileges on the target system.
It is reported that a local user can send 2 to 3 gigabytes of data to a target user's screen to trigger a flaw in 'ansi.c'. A large amount of data can reportedly cause the 'w_NumArgs' signed integer to overflow to a negative value, causing a check to ensure that the number of arguments is less than 'MAXARGS' to fail.
The report indicates that screen is typically installed with set user id (setuid) root user privileges of set group id (setgid) utmp group privileges.
The vendor has reportedly been notified.
|
Impact:
A local user can execute arbitrary code with the privileges of GNU screen (which may be root user privileges or utmp group privileges, depending on the installation).
|
Solution:
SCO has issued the following fixes:
OpenLinux 3.1.1 Server:
Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/RPMS
Packages
95d5288f69a948437aa5e078216db7b2 screen-3.9.10-2.i386.rpm
Installation
rpm -Fvh screen-3.9.10-2.i386.rpm
Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/SRPMS
Source Packages
4e2ec4db363fdc65d8e46fe3e645d949 screen-3.9.10-2.src.rpm
OpenLinux 3.1.1 Workstation:
Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/RPMS
Packages
7edc6ee34b38dd0b20b4cacdf0899898 screen-3.9.10-2.i386.rpm
Installation
rpm -Fvh screen-3.9.10-2.i386.rpm
Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/SRPMS
Source Packages
bfe39326a2fffc971856890eea5a1758 screen-3.9.10-2.src.rpm
|
Vendor URL: www.gnu.org/software/screen/screen.html (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Caldera/SCO)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 2 Mar 2004 20:23:36 -0800 (PST)
Subject: [Full-Disclosure] OpenLinux: screen buffer overflow
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SCO Security Advisory
Subject: OpenLinux: screen buffer overflow
Advisory number: CSSA-2004-011.0
Issue date: 2004 March 02
Cross reference: sr888392 fz528595 erg712512 CAN-2003-0972
______________________________________________________________________________
1. Problem Description
Integer signedness error in ansi.c for GNU screen 4.0.1 and
earlier, and 3.9.15 and earlier, could allows local users to
execute arbitrary code via a large number of characters in
escape sequences, which leads to a buffer overflow.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2003-0972 to this issue.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to screen-3.9.10-2.i386.rpm
OpenLinux 3.1.1 Workstation prior to screen-3.9.10-2.i386.rpm
3. Solution
The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater, called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/RPMS
4.2 Packages
95d5288f69a948437aa5e078216db7b2 screen-3.9.10-2.i386.rpm
4.3 Installation
rpm -Fvh screen-3.9.10-2.i386.rpm
4.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/SRPMS
4.5 Source Packages
4e2ec4db363fdc65d8e46fe3e645d949 screen-3.9.10-2.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/RPMS
5.2 Packages
7edc6ee34b38dd0b20b4cacdf0899898 screen-3.9.10-2.i386.rpm
5.3 Installation
rpm -Fvh screen-3.9.10-2.i386.rpm
5.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/SRPMS
5.5 Source Packages
bfe39326a2fffc971856890eea5a1758 screen-3.9.10-2.src.rpm
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0972
http://marc.theaimsgroup.com/?l=bugtraq&m=106995837813873&w=2
http://groups.yahoo.com/group/gnu-screen/message/3118
http://www.securitytracker.com/alerts/2003/Nov/1008321.html
SCO security resources:
http://www.sco.com/support/security/index.html
This security fix closes SCO incidents sr888392 fz528595
erg712512.
7. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.
8. Acknowledgements
SCO would like to thank Timo Sirainen
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)
iD8DBQFARVkGbluZssSXDTERAon5AJ9oQxSMsjmJAtdc+f2c3MLXQZQLLQCfbwXh
G117t90/rMatYuDWGtDpqcs=
=Uqh3
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
