Jesse Keating
27/01/04, 21:35
=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated screen resolves security vulnerability
Advisory ID: FLSA:1187
Issue date: 2004-01-26
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1187
CVE Names: CAN-2003-0972
=2D -----------------------------------------------------------------------
1. Topic:
Updated screen packages are now available that fix a security=20
vulnerability which may allow privilege escalation for local users, and=20
possibly remote attacks or getting control of another user's screen.
2. Relevant releases/architectures:
Red Hat Linux 7.2 - i386
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386
3. Problem description:
The screen utility allows you to have multiple logins on just one
terminal. Screen is useful for users who telnet into a machine or are
connected via a dumb terminal, but want to use more than just one
login.
Timo Sirainen has reported an integer signedness error in ansi.c for GNU=20
screen 4.0.1 and earlier, and 3.9.15 and earlier, which allows local=20
users to execute arbitrary code via a large number of ";" (semicolon)=20
characters in escape sequences, which leads to a buffer overflow. The=20
Common Vulnerabilities and Exposures project (cve.mitre.org) has=20
assigned the name CAN-2003-0966 to this issue.
Users of screen should update to these update packages, which contain a=20
backported security patch that corrects this issue.
=46edora Legacy would like to thank Timo Sirainen for discovering and=20
disclosing this issue, and Jason Rohwedder and Christian Pearce for=20
providing a backported fix for Red Hat Linux 7.2, 7.3, and 8.0.
All users are advised to upgrade to these update packages, which contain=20
a backported security patch that corrects this issue.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which=20
are not installed but included in the list will not be updated. Note=20
that you can also use wildcards (*.rpm) if your current directory=20
*only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the=20
appropriate RPMs being upgraded on your system. This assumes that you=20
have yum or apt-get configured for obtaining Fedora Legacy content. =20
Please visit http://www.fedoralegacy.org/download for directions on how=20
to configure yum and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1187 - screen security patch in rh7x, rh8
6. RPMs required:
Red Hat Linux 7.2:
SRPMS:
http://download.fedoralegacy.org/redhat/7.2/updates/SRPMS/screen-3.9.9-4.le=
gacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.2/updates/i386/screen-3.9.9-4.leg=
acy.i386.rpm
Red Hat Linux 7.3:
SRPMS:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/screen-3.9.11-4.l=
egacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/screen-3.9.11-4.le=
gacy.i386.rpm
Red Hat Linux 8.0:
SRPMS:
http://download.fedoralegacy.org/redhat/8.0/updates/SRPMS/screen-3.9.11-11.=
legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/8.0/updates/i386/screen-3.9.11-11.l=
egacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
194fbeb6e1871aad733966eb03525ee3fa6b736e =20
7.2/updates/SRPMS/screen-3.9.9-4.legacy.src.rpm
38752ec03ec07ab125ab495910861d0317dfe095 =20
7.2/updates/i386/screen-3.9.9-4.legacy.i386.rpm
=20
e22108165eeb8a4f2d6f078600117d2a3b5dc88d =20
7.3/updates/SRPMS/screen-3.9.11-4.legacy.src.rpm
278a76f5b56d32bc983ab5dc388397c98dffe31c =20
7.3/updates/i386/screen-3.9.11-4.legacy.i386.rpm
=20
578b3166a0f647ac2a798ad81bdea43c9fe55c7b =20
8.0/updates/SRPMS/screen-3.9.11-11.legacy.src.rpm
c1422da61421e74a5a66e5404f1fcd33134c07e8 =20
8.0/updates/i386/screen-3.9.11-11.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0972
http://marc.theaimsgroup.com/?l=3Dbugtraq&m=3D106995837813873&w=3D2
https://bugzilla.fedora.us/show_bug.cgi?id=3D1187
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at https://www.fedoralegacy.org
=2D --=20
Jesse Keating RHCE (geek.j2solutions.net)
=46edora Legacy Team (www.fedoralegacy.org)
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQFAFe024v2HLvE71NURApqbAJsFYrZHZWxgUVkzzcHHT9 4nZ4ZH3QCcC+40
AIDfcZtx909sf83Aop6DAR8=3D
=3D8quP
=2D----END PGP SIGNATURE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated screen resolves security vulnerability
Advisory ID: FLSA:1187
Issue date: 2004-01-26
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1187
CVE Names: CAN-2003-0972
=2D -----------------------------------------------------------------------
1. Topic:
Updated screen packages are now available that fix a security=20
vulnerability which may allow privilege escalation for local users, and=20
possibly remote attacks or getting control of another user's screen.
2. Relevant releases/architectures:
Red Hat Linux 7.2 - i386
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386
3. Problem description:
The screen utility allows you to have multiple logins on just one
terminal. Screen is useful for users who telnet into a machine or are
connected via a dumb terminal, but want to use more than just one
login.
Timo Sirainen has reported an integer signedness error in ansi.c for GNU=20
screen 4.0.1 and earlier, and 3.9.15 and earlier, which allows local=20
users to execute arbitrary code via a large number of ";" (semicolon)=20
characters in escape sequences, which leads to a buffer overflow. The=20
Common Vulnerabilities and Exposures project (cve.mitre.org) has=20
assigned the name CAN-2003-0966 to this issue.
Users of screen should update to these update packages, which contain a=20
backported security patch that corrects this issue.
=46edora Legacy would like to thank Timo Sirainen for discovering and=20
disclosing this issue, and Jason Rohwedder and Christian Pearce for=20
providing a backported fix for Red Hat Linux 7.2, 7.3, and 8.0.
All users are advised to upgrade to these update packages, which contain=20
a backported security patch that corrects this issue.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which=20
are not installed but included in the list will not be updated. Note=20
that you can also use wildcards (*.rpm) if your current directory=20
*only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the=20
appropriate RPMs being upgraded on your system. This assumes that you=20
have yum or apt-get configured for obtaining Fedora Legacy content. =20
Please visit http://www.fedoralegacy.org/download for directions on how=20
to configure yum and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1187 - screen security patch in rh7x, rh8
6. RPMs required:
Red Hat Linux 7.2:
SRPMS:
http://download.fedoralegacy.org/redhat/7.2/updates/SRPMS/screen-3.9.9-4.le=
gacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.2/updates/i386/screen-3.9.9-4.leg=
acy.i386.rpm
Red Hat Linux 7.3:
SRPMS:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/screen-3.9.11-4.l=
egacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/screen-3.9.11-4.le=
gacy.i386.rpm
Red Hat Linux 8.0:
SRPMS:
http://download.fedoralegacy.org/redhat/8.0/updates/SRPMS/screen-3.9.11-11.=
legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/8.0/updates/i386/screen-3.9.11-11.l=
egacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
194fbeb6e1871aad733966eb03525ee3fa6b736e =20
7.2/updates/SRPMS/screen-3.9.9-4.legacy.src.rpm
38752ec03ec07ab125ab495910861d0317dfe095 =20
7.2/updates/i386/screen-3.9.9-4.legacy.i386.rpm
=20
e22108165eeb8a4f2d6f078600117d2a3b5dc88d =20
7.3/updates/SRPMS/screen-3.9.11-4.legacy.src.rpm
278a76f5b56d32bc983ab5dc388397c98dffe31c =20
7.3/updates/i386/screen-3.9.11-4.legacy.i386.rpm
=20
578b3166a0f647ac2a798ad81bdea43c9fe55c7b =20
8.0/updates/SRPMS/screen-3.9.11-11.legacy.src.rpm
c1422da61421e74a5a66e5404f1fcd33134c07e8 =20
8.0/updates/i386/screen-3.9.11-11.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0972
http://marc.theaimsgroup.com/?l=3Dbugtraq&m=3D106995837813873&w=3D2
https://bugzilla.fedora.us/show_bug.cgi?id=3D1187
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at https://www.fedoralegacy.org
=2D --=20
Jesse Keating RHCE (geek.j2solutions.net)
=46edora Legacy Team (www.fedoralegacy.org)
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQFAFe024v2HLvE71NURApqbAJsFYrZHZWxgUVkzzcHHT9 4nZ4ZH3QCcC+40
AIDfcZtx909sf83Aop6DAR8=3D
=3D8quP
=2D----END PGP SIGNATURE-----