Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Apps N-Z :: hack1091.htm

screen buffer overflow (OpenLinux)
OpenLinux: screen buffer overflow

Hash: SHA1


			SCO Security Advisory

Subject:		OpenLinux: screen buffer overflow
Advisory number: 	CSSA-2004-011.0
Issue date: 		2004 March 02
Cross reference:	sr888392 fz528595 erg712512 CAN-2003-0972

1. Problem Description

	Integer signedness error in ansi.c for GNU screen 4.0.1 and 
	earlier, and 3.9.15 and earlier, could allows local users to 
	execute arbitrary code via a large number of characters in 
	escape sequences, which leads to a buffer overflow.

	The Common Vulnerabilities and Exposures project ( 
	has assigned the name CAN-2003-0972 to this issue.

2. Vulnerable Supported Versions

	System				Package
	OpenLinux 3.1.1 Server		prior to screen-3.9.10-2.i386.rpm
	OpenLinux 3.1.1 Workstation	prior to screen-3.9.10-2.i386.rpm

3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.

4. OpenLinux 3.1.1 Server

	4.1 Package Location 1.0/RPMS

	4.2 Packages

	95d5288f69a948437aa5e078216db7b2	screen-3.9.10-2.i386.rpm

	4.3 Installation

	rpm -Fvh screen-3.9.10-2.i386.rpm

	4.4 Source Package Location 1.0/SRPMS

	4.5 Source Packages

	4e2ec4db363fdc65d8e46fe3e645d949	screen-3.9.10-2.src.rpm

5. OpenLinux 3.1.1 Workstation

	5.1 Package Location 4-011.0/RPMS

	5.2 Packages

	7edc6ee34b38dd0b20b4cacdf0899898	screen-3.9.10-2.i386.rpm

	5.3 Installation

	rpm -Fvh screen-3.9.10-2.i386.rpm

	5.4 Source Package Location 4-011.0/SRPMS

	5.5 Source Packages

	bfe39326a2fffc971856890eea5a1758	screen-3.9.10-2.src.rpm

6. References

	Specific references for this advisory: 

	SCO security resources: 

	This security fix closes SCO incidents sr888392 fz528595

7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.

8. Acknowledgements

	SCO would like to thank Timo Sirainen


Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH