OpenBSD GNU Screen Locked Authentication Bypass Vulnerability

Bugtraq ID:	29810
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 04 2007 12:00AM
Updated:	Nov 12 2008 04:04PM
Credit:	Rembrandt <rembrandt_at_jpberlin.de>
Vulnerable:	GNU screen 4.0.3 + OpenBSD OpenBSD 4.3
Not Vulnerable:

OpenBSD GNU Screen Locked Authentication Bypass Vulnerability

GNU Screen for OpenBSD is prone to a vulnerability that allows local attackers to bypass the password prompt to unlock the screen.

An attacker with local physical access to the console can exploit this issue to bypass the password prompt and gain access to the locked screen session.

The issue affects GNU Screen 4.0.3 for OpenBSD 4.3; other versions may also be vulnerable.

OpenBSD GNU Screen Locked Authentication Bypass Vulnerability

To exploit the issue, an attacker with physical console access can use standard commands.

The following proof of concept is available:

• /data/vulnerabilities/exploits/29810.txt

OpenBSD GNU Screen Locked Authentication Bypass Vulnerability

Solution:
An unofficial fix is available for OpenBSD. Please see the references for more information.

OpenBSD GNU Screen Locked Authentication Bypass Vulnerability

References:

• Re: [screen-devel] ctrl-c Bug? :-) (Micah Cowan)
  
• GNU Screen Homepage (GNU)
  
• OpenBSD Homepage (OpenBSD)
  
• patch: misc/screen (Tobias Ulmer)