PT-2020-16673 · Tmux+4 · Tmux+4

Sergey Nizovtsev · Published 2020-11-04 · Updated 2024-06-15 · CVE-2020-27347

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tmux versions prior to 3.1c

Description The issue is related to a stack-based buffer overflow in the input csi dispatch sgr colon() function, located in the input.c file. This overflow can be exploited through terminal output, specifically by using a specially crafted escape sequence. The vulnerability can be triggered by displaying malicious content on the screen, such as when viewing a malicious webpage through curl, logging into a malicious host via SSH, or displaying log content that may contain attacker data.

Recommendations For tmux versions prior to 3.1c, update to version 3.1c or later to resolve the issue. As a temporary workaround, consider disabling the input csi dispatch sgr colon() function until a patch is available. Restrict access to the input.c file to minimize the risk of exploitation. Avoid using escape sequences in terminal output until the issue is resolved.

Exploit

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

ALT-PU-2020-3216

ALT-PU-2020-3265

CVE-2020-27347

OPENSUSE-SU-2020:1834-1

OPENSUSE-SU-2020_1834-1

OPENSUSE-SU-2024:11466-1

USN-4618-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Tmux

References · 30

• 🔥 https://openwall.com/lists/oss-security/2020/11/05/3 · Exploit
• https://github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701c · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2020:1834-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27347 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-27347 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-27347 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-27347 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27347 · Security Note
• https://ubuntu.com/security/notices/USN-4618-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27347 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4618-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202011-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27347 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11466-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27347 · Vendor Advisory