SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Screen Vendors:   GNU [multiple authors]
(SCO Issues Fix for OpenLinux) GNU Screen Integer Overflow in 'ansi.c' May Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1009320
SecurityTracker URL:  http://securitytracker.com/id/1009320
CVE Reference:   CVE-2003-0972   (Links to External Site)
Date:  Mar 5 2004
Impact:   Execution of arbitrary code via local system, Root access via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.0.1, 3.9.15, and prior versions
Description:   A vulnerability was reported in GNU Screen. A local user may be able to execute arbitrary code to gain elevated privileges on the target system.

It is reported that a local user can send 2 to 3 gigabytes of data to a target user's screen to trigger a flaw in 'ansi.c'. A large amount of data can reportedly cause the 'w_NumArgs' signed integer to overflow to a negative value, causing a check to ensure that the number of arguments is less than 'MAXARGS' to fail.

The report indicates that screen is typically installed with set user id (setuid) root user privileges of set group id (setgid) utmp group privileges.

The vendor has reportedly been notified.

Impact:   A local user can execute arbitrary code with the privileges of GNU screen (which may be root user privileges or utmp group privileges, depending on the installation).
Solution:   SCO has issued the following fixes:

OpenLinux 3.1.1 Server:

Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/RPMS

Packages

95d5288f69a948437aa5e078216db7b2 screen-3.9.10-2.i386.rpm

Installation

rpm -Fvh screen-3.9.10-2.i386.rpm

Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/SRPMS

Source Packages

4e2ec4db363fdc65d8e46fe3e645d949 screen-3.9.10-2.src.rpm


OpenLinux 3.1.1 Workstation:

Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/RPMS

Packages

7edc6ee34b38dd0b20b4cacdf0899898 screen-3.9.10-2.i386.rpm

Installation

rpm -Fvh screen-3.9.10-2.i386.rpm

Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/SRPMS

Source Packages

bfe39326a2fffc971856890eea5a1758 screen-3.9.10-2.src.rpm

Vendor URL:  www.gnu.org/software/screen/screen.html (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  3.1.1

Message History:   This archive entry is a follow-up to the message listed below.
Nov 27 2003 GNU Screen Integer Overflow in 'ansi.c' May Let Local Users Gain Elevated Privileges



 Source Message Contents

Subject:  [Full-Disclosure] OpenLinux: screen buffer overflow



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenLinux: screen buffer overflow
Advisory number: 	CSSA-2004-011.0
Issue date: 		2004 March 02
Cross reference:	sr888392 fz528595 erg712512 CAN-2003-0972
______________________________________________________________________________


1. Problem Description

	Integer signedness error in ansi.c for GNU screen 4.0.1 and 
	earlier, and 3.9.15 and earlier, could allows local users to 
	execute arbitrary code via a large number of characters in 
	escape sequences, which leads to a buffer overflow.

	The Common Vulnerabilities and Exposures project (cve.mitre.org) 
	has assigned the name CAN-2003-0972 to this issue.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------
	OpenLinux 3.1.1 Server		prior to screen-3.9.10-2.i386.rpm
	OpenLinux 3.1.1 Workstation	prior to screen-3.9.10-2.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/RPMS

	4.2 Packages

	95d5288f69a948437aa5e078216db7b2	screen-3.9.10-2.i386.rpm

	4.3 Installation

	rpm -Fvh screen-3.9.10-2.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-011.0/SRPMS

	4.5 Source Packages

	4e2ec4db363fdc65d8e46fe3e645d949	screen-3.9.10-2.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/RPMS

	5.2 Packages

	7edc6ee34b38dd0b20b4cacdf0899898	screen-3.9.10-2.i386.rpm

	5.3 Installation

	rpm -Fvh screen-3.9.10-2.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-011.0/SRPMS

	5.5 Source Packages

	bfe39326a2fffc971856890eea5a1758	screen-3.9.10-2.src.rpm


6. References

	Specific references for this advisory:
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0972
		http://marc.theaimsgroup.com/?l=bugtraq&m=106995837813873&w=2
		http://groups.yahoo.com/group/gnu-screen/message/3118
		http://www.securitytracker.com/alerts/2003/Nov/1008321.html

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr888392 fz528595
	erg712512.


7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.


8. Acknowledgements

	SCO would like to thank Timo Sirainen

______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

iD8DBQFARVkGbluZssSXDTERAon5AJ9oQxSMsjmJAtdc+f2c3MLXQZQLLQCfbwXh
G117t90/rMatYuDWGtDpqcs=
=Uqh3
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC