PT-2021-3613 · Unknown+7 · Gnu Screen+7

Tavis Ormandy · Published 2021-02-09 · Updated 2024-06-15 · CVE-2021-26937

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNU Screen versions through 4.8.0

Description The issue is related to incorrect handling of UTF-8 character sequences in the encoding.c component of GNU Screen. This can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service, potentially leading to an application crash.

Recommendations For GNU Screen versions through 4.8.0, update to a version later than 4.8.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

ALT-PU-2021-3263

ALT-PU-2021-3266

ALT-PU-2021-3614

AZL-7356

BDU:2021-03746

CESA-2021_0742

CVE-2021-26937

DLA-2570-1

DSA-4861-1

MGASA-2021-0109

OESA-2021-1090

OPENSUSE-SU-2021:0304-1

OPENSUSE-SU-2021_0304-1

OPENSUSE-SU-2024:11884-1

RHSA-2021:0742

RHSA-2021_0742

RHSA-2022:1074

SUSE-SU-2021:0491-1

SUSE-SU-2021:0492-1

SUSE-SU-2021_0491-1

SUSE-SU-2021_0492-1

USN-4747-1

USN-4747-2

Affected Products

Alt Linux

Astra Linux

Centos

Gnu Screen

Linuxmint

Red Hat

Suse

Ubuntu

References · 56

• 🔥 https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html · Exploit
• 🔥 https://openwall.com/lists/oss-security/2021/02/09/3 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2021/02/09/8 · Exploit
• https://osv.dev/vulnerability/USN-4747-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0491-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0492-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-26937 · Vendor Advisory
• https://debian.org/security/2021/dsa-4861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26937 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-26937 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-26937 · Vendor Advisory
• https://security.gentoo.org/glsa/202105-11 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4861-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4747-1 · Vendor Advisory