=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory

Synopsis: Updated screen resolves security vulnerability
Advisory ID: FLSA:1187
Issue date: 2004-01-26
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1187
CVE Names: CAN-2003-0972
=2D -----------------------------------------------------------------------

1. Topic:

Updated screen packages are now available that fix a security=20
vulnerability which may allow privilege escalation for local users, and=20
possibly remote attacks or getting control of another user's screen.

2. Relevant releases/architectures:

Red Hat Linux 7.2 - i386
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386

3. Problem description:

The screen utility allows you to have multiple logins on just one
terminal. Screen is useful for users who telnet into a machine or are
connected via a dumb terminal, but want to use more than just one
login.

Timo Sirainen has reported an integer signedness error in ansi.c for GNU=20
screen 4.0.1 and earlier, and 3.9.15 and earlier, which allows local=20
users to execute arbitrary code via a large number of ";" (semicolon)=20
characters in escape sequences, which leads to a buffer overflow. The=20
Common Vulnerabilities and Exposures project (cve.mitre.org) has=20
assigned the name CAN-2003-0966 to this issue.

Users of screen should update to these update packages, which contain a=20
backported security patch that corrects this issue.

=46edora Legacy would like to thank Timo Sirainen for discovering and=20
disclosing this issue, and Jason Rohwedder and Christian Pearce for=20
providing a backported fix for Red Hat Linux 7.2, 7.3, and 8.0.

All users are advised to upgrade to these update packages, which contain=20
a backported security patch that corrects this issue.

4. Solution:

Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which=20
are not installed but included in the list will not be updated. Note=20
that you can also use wildcards (*.rpm) if your current directory=20
*only* contains the desired RPMs.

Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the=20
appropriate RPMs being upgraded on your system. This assumes that you=20
have yum or apt-get configured for obtaining Fedora Legacy content. =20
Please visit http://www.fedoralegacy.org/download for directions on how=20
to configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1187 - screen security patch in rh7x, rh8

6. RPMs required:

Red Hat Linux 7.2:

SRPMS:
http://download.fedoralegacy.org/red...en-3.9.9-4.le=
gacy.src.rpm
i386:
http://download.fedoralegacy.org/red...n-3.9.9-4.leg=
acy.i386.rpm

Red Hat Linux 7.3:

SRPMS:
http://download.fedoralegacy.org/red...en-3.9.11-4.l=
egacy.src.rpm
i386:
http://download.fedoralegacy.org/red...n-3.9.11-4.le=
gacy.i386.rpm

Red Hat Linux 8.0:

SRPMS:
http://download.fedoralegacy.org/red...en-3.9.11-11.=
legacy.src.rpm
i386:
http://download.fedoralegacy.org/red...n-3.9.11-11.l=
egacy.i386.rpm

7. Verification:

SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
194fbeb6e1871aad733966eb03525ee3fa6b736e =20
7.2/updates/SRPMS/screen-3.9.9-4.legacy.src.rpm
38752ec03ec07ab125ab495910861d0317dfe095 =20
7.2/updates/i386/screen-3.9.9-4.legacy.i386.rpm
=20
e22108165eeb8a4f2d6f078600117d2a3b5dc88d =20
7.3/updates/SRPMS/screen-3.9.11-4.legacy.src.rpm
278a76f5b56d32bc983ab5dc388397c98dffe31c =20
7.3/updates/i386/screen-3.9.11-4.legacy.i386.rpm
=20
578b3166a0f647ac2a798ad81bdea43c9fe55c7b =20
8.0/updates/SRPMS/screen-3.9.11-11.legacy.src.rpm
c1422da61421e74a5a66e5404f1fcd33134c07e8 =20
8.0/updates/i386/screen-3.9.11-11.legacy.i386.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:

sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename...DCAN-2003-0972
http://marc.theaimsgroup.com/?l=3Dbu...37813873&w=3D2
https://bugzilla.fedora.us/show_bug.cgi?id=3D1187

9. Contact:

The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at https://www.fedoralegacy.org

=2D --=20
Jesse Keating RHCE (geek.j2solutions.net)
=46edora Legacy Team (www.fedoralegacy.org)
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQFAFe024v2HLvE71NURApqbAJsFYrZHZWxgUVkzzcHHT9 4nZ4ZH3QCcC+40
AIDfcZtx909sf83Aop6DAR8=3D
=3D8quP
=2D----END PGP SIGNATURE-----