Multiple unspecified vulnerabilities in the 'utf8 combining characters handling' (utf8_handle_comb function in encoding.c) in screen before 4.0.3 allows user-assisted attackers to cause a denial of service (crash or hang) via certain UTF8 sequences.

Updated packages have been patched to correct this issue.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2007-005 applied. 

This update fixes security flaws in the following applications :

Alias Manager BIND CoreGraphics crontabs fetchmail file iChat mDNSResponder PPP ruby screen texinfo VPN

A special formed UTF-8 sequence in text could be used to crash the terminal multitasker screen by overwriting memory in the heap. This is potentially exploitable to execute code. (CVE-2006-4573)

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - screen buffer overflow (CVE-2006-4573)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

cstone and Rich Felker discovered a programming error in the UTF8 string handling code of 'screen' leading to a denial of service. If a crafted string was displayed within a screen session, screen would crash or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New screen packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix a security issue.

A vulnerability in the handling of combined UTF-8 characters in screen may allow an user-assisted attacker to crash screen or potentially allow code execution as the user running screen. To exploit this issue the user running scren must in some way interact with the attacker.

'cstone' and Rich Felker discovered that specially crafted UTF-8 sequences may lead an out of bands memory write when displayed inside the screen terminal multiplexer, allowing denial of service and potentially the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200611-01 (Screen: UTF-8 character handling vulnerability)

    cstone and Richard Felker discovered a flaw in Screen's UTF-8 combining     character handling.
  Impact :

    The vulnerability can be exploited by writing a special string of     characters to a Screen window. A remote attacker could cause a Denial     of Service or possibly execute arbitrary code with the privileges of     the user running Screen through a program being run inside a Screen     session, such as an IRC client or a mail client.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
24576	Mandrake Linux Security Advisory : screen (MDKSA-2006:191)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	low
25297	Mac OS X Multiple Vulnerabilities (Security Update 2007-005)	Nessus	MacOS X Local Security Checks	2007/5/25	2024/5/28	critical
41104	SuSE9 Security Update : screen (YOU Patch Number 11260)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	low
198404	RHEL 4 : screen (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
29578	SuSE 10 Security Update : screen (ZYPP Patch Number 2199)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	low
27951	Ubuntu 5.04 / 5.10 / 6.06 LTS / 6.10 : screen vulnerability (USN-370-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	low
24658	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : screen (SSA:2006-307-02)	Nessus	Slackware Local Security Checks	2007/2/18	2021/1/14	low
27433	openSUSE 10 Security Update : screen (screen-2198)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	low
22925	FreeBSD : screen -- combined UTF-8 characters vulnerability (b318dc8c-6756-11db-83c3-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	2006/10/30	2021/1/6	low
22934	Debian DSA-1202-1 : screen - programming error	Nessus	Debian Local Security Checks	2006/11/6	2021/1/4	low
22939	GLSA-200611-01 : Screen: UTF-8 character handling vulnerability	Nessus	Gentoo Local Security Checks	2006/11/6	2021/1/6	low

偵測

搜尋 Plugin

low

critical

low

critical

low

low

low

low

low

low

low