Vulnerability Note VU#524227

GNU screen contains buffer overflow

Screen is a full-screen window manager that multiplexes a physical terminal between several processes, typically interactive shells. Each virtual terminal provides the functions of the DEC VT100 terminal and, in addition, several control functions from the ANSI X3.64 (ISO 6429) and ISO 2022 standards (e.g., insert/delete line and support for multiple character sets). There is a scrollback history buffer for each virtual terminal and a copy-and-paste mechanism that allows the user to move text regions between windows. When screen is called, it creates a single window with a shell in it (or the specified command) and then gets out of your way so that you can use the program as you normally would. Then, at any time, you can create new (full-screen) windows with other programs in them (including more shells), kill the current window, view a list of the active windows, turn output logging on and off, copy text between windows, view the scrollback history, switch between windows, etc. All windows run their programs completely independent of each other. Programs continue to run when their window is currently not visible and even when the whole screen session is detached from the users terminal.

Systems Affected

http://groups.yahoo.com/group/gnu-screen/message/981
http://groups.yahoo.com/group/gnu-screen/message/980
http://www.gnu.org/software/screen/screen.html
http://www.securityfocus.com/bid/4578

Credit

This vulnerability was discovered by Gobbles.

This document was written by Ian A. Finlay.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.