GNU Screen Multiple Denial of Service Vulnerabilities
BID:20727
Info
GNU Screen Multiple Denial of Service Vulnerabilities
| Bugtraq ID: | 20727 |
| Class: | Unknown |
| CVE: |
CVE-2006-4573 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 25 2006 12:00AM |
| Updated: | May 25 2007 04:21PM |
| Credit: | cstone & Rich Felker discovered these issues. |
| Vulnerable: |
Ubuntu Ubuntu Linux 5.10 sparc Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux 11.0 rPath rPath Linux 1 OpenPKG OpenPKG 2.5 OpenPKG OpenPKG 2.4 OpenPKG OpenPKG 2.3 OpenPKG OpenPKG 2.2 OpenPKG OpenPKG 2.1 OpenPKG OpenPKG 2.0 OpenPKG OpenPKG 1.3 OpenPKG OpenPKG 1.2 OpenPKG OpenPKG 1.1 OpenPKG OpenPKG 1.0 OpenPKG OpenPKG Stable OpenPKG OpenPKG Current Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 GNU screen 4.0.2 GNU screen 4.0.1 GNU screen 3.9.15 GNU screen 3.9.13 GNU screen 3.9.11 GNU screen 3.9.10 GNU screen 3.9.9 GNU screen 3.9.8 GNU screen 3.9.4 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 |
| Not Vulnerable: |
GNU screen 4.0.3 |
Discussion
GNU Screen Multiple Denial of Service Vulnerabilities
GNU Screen is prone to multiple denial-of-service vulnerabilities. A remote attacker may trigger these issues and deny services to legitimate users.
GNU Screen versions prior to 4.0.3 are affected by these vulnerabilities.
GNU Screen is prone to multiple denial-of-service vulnerabilities. A remote attacker may trigger these issues and deny services to legitimate users.
GNU Screen versions prior to 4.0.3 are affected by these vulnerabilities.
Exploit / POC
GNU Screen Multiple Denial of Service Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution / Fix
GNU Screen Multiple Denial of Service Vulnerabilities
Solution:
The vendor has released Screen 4.0.3 to address these issues. Please see the referenced advisories for more information.
Apple Mac OS X Server 10.3.9
Apple Mac OS X Server 10.4.9
Apple Mac OS X 10.4.9
GNU screen 3.9.10
GNU screen 3.9.11
GNU screen 3.9.13
GNU screen 3.9.15
GNU screen 3.9.4
GNU screen 3.9.8
GNU screen 3.9.9
GNU screen 4.0.1
GNU screen 4.0.2
Solution:
The vendor has released Screen 4.0.3 to address these issues. Please see the referenced advisories for more information.
Apple Mac OS X Server 10.3.9
-
Apple SecUpdSrvr2007-005Pan.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13993&cat= 1&platform=osx&method=sa/SecUpdSrvr2007-005Pan.dmg
Apple Mac OS X Server 10.4.9
-
Apple SecUpd2007-005Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13995&cat= 1&platform=osx&method=sa/SecUpd2007-005Ti.dmg -
Apple SecUpd2007-005Univ.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13998&cat= 1&platform=osx&method=sa/SecUpd2007-005Univ.dmg
Apple Mac OS X 10.4.9
-
Apple SecUpd2007-005Ti.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13995&cat= 1&platform=osx&method=sa/SecUpd2007-005Ti.dmg -
Apple SecUpd2007-005Univ.dmg
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13998&cat= 1&platform=osx&method=sa/SecUpd2007-005Univ.dmg
GNU screen 3.9.10
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 3.9.11
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 3.9.13
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 3.9.15
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 3.9.4
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 3.9.8
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 3.9.9
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 4.0.1
-
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz
GNU screen 4.0.2
-
Debian screen_4.0.2-4.1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_alpha.deb -
Debian screen_4.0.2-4.1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_amd64.deb -
Debian screen_4.0.2-4.1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_arm.deb -
Debian screen_4.0.2-4.1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_hppa.deb -
Debian screen_4.0.2-4.1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_i386.deb -
Debian screen_4.0.2-4.1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_ia64.deb -
Debian screen_4.0.2-4.1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_m68k.deb -
Debian screen_4.0.2-4.1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_mips.deb -
Debian screen_4.0.2-4.1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_mipsel.deb -
Debian screen_4.0.2-4.1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_powerpc.deb -
Debian screen_4.0.2-4.1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/s/screen/screen_4.0.2-4.1 sarge1_s390.deb -
GNU screen-4.0.3.tar.gz
ftp://ftp.uni-erlangen.de/pub/utilities/screen/screen-4.0.3.tar.gz -
Mandriva screen-4.0.2-1.1.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva screen-4.0.2-1.1.C30mdk.x86_64.rpm
Corporate 3.0/X86_64:
http://www.mandriva.com/en/download -
Mandriva screen-4.0.2-6.1.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://www.mandriva.com/en/download -
Mandriva screen-4.0.2-6.1.20060mdk.x86_64.rpm
Mandriva Linux 2006.0:
http://www.mandriva.com/en/download -
Mandriva screen-4.0.2-6.1.20060mlcs4.i586.rpm
Corporate 4.0:
http://www.mandriva.com/en/download -
Mandriva screen-4.0.2-6.1.20060mlcs4.x86_64.rpm
Corporate 4.0/X86_64:
http://www.mandriva.com/en/download -
Mandriva screen-4.0.2-9.1mdv2007.0.i586.rpm
Mandriva Linux 2007.0:
http://www.mandriva.com/en/download -
Mandriva screen-4.0.2-9.1mdv2007.0.x86_64.rpm
Mandriva Linux 2007.0:
http://www.mandriva.com/en/download -
Slackware screen-4.0.3-i386-1_slack8.1.tgz
Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/s creen-4.0.3-i386-1_slack8.1.tgz -
Slackware screen-4.0.3-i386-1_slack9.0.tgz
Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/s creen-4.0.3-i386-1_slack9.0.tgz -
Slackware screen-4.0.3-i486-1_slack10.0.tgz
Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ screen-4.0.3-i486-1_slack10.0.tgz -
Slackware screen-4.0.3-i486-1_slack10.1.tgz
Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ screen-4.0.3-i486-1_slack10.1.tgz -
Slackware screen-4.0.3-i486-1_slack10.2.tgz
Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ screen-4.0.3-i486-1_slack10.2.tgz -
Slackware screen-4.0.3-i486-1_slack11.0.tgz
Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/ screen-4.0.3-i486-1_slack11.0.tgz -
Slackware screen-4.0.3-i486-1_slack9.1.tgz
Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/s creen-4.0.3-i486-1_slack9.1.tgz -
Ubuntu screen_4.0.2-4.1ubuntu2.5.04_amd64.deb
Ubuntu 5.04:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu2.5.04_amd64.deb -
Ubuntu screen_4.0.2-4.1ubuntu2.5.04_i386.deb
Ubuntu 5.04:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu2.5.04_i386.deb -
Ubuntu screen_4.0.2-4.1ubuntu2.5.04_powerpc.deb
Ubuntu 5.04:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu2.5.04_powerpc.deb -
Ubuntu screen_4.0.2-4.1ubuntu2.5.10_amd64.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu2.5.10_amd64.deb -
Ubuntu screen_4.0.2-4.1ubuntu2.5.10_i386.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu2.5.10_i386.deb -
Ubuntu screen_4.0.2-4.1ubuntu2.5.10_powerpc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu2.5.10_powerpc.deb -
Ubuntu screen_4.0.2-4.1ubuntu2.5.10_sparc.deb
Ubuntu 5.10:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu2.5.10_sparc.deb -
Ubuntu screen_4.0.2-4.1ubuntu5.6.06_amd64.deb
Ubuntu 6.06 LTS:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu5.6.06_amd64.deb -
Ubuntu screen_4.0.2-4.1ubuntu5.6.06_i386.deb
Ubuntu 6.06 LTS:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu5.6.06_i386.deb -
Ubuntu screen_4.0.2-4.1ubuntu5.6.06_powerpc.deb
Ubuntu 6.06 LTS:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu5.6.06_powerpc.deb -
Ubuntu screen_4.0.2-4.1ubuntu5.6.06_sparc.deb
Ubuntu 6.06 LTS:
http://security.ubuntu.com/ubuntu/pool/main/s/screen/screen_4.0.2-4.1u buntu5.6.06_sparc.deb
References
GNU Screen Multiple Denial of Service Vulnerabilities
References:
References:
- GNU Screen Homepage (GNU)
- Secfix release for screen: screen-4.0.3 (Michael Schroeder)