CVE-2017-5618 GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
HighCVSS 7.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/screen(Debian:12) | < 4.5.0-3 | 4.5.0-3 |
| debian/screen(Debian:13) | < 4.5.0-3 | 4.5.0-3 |
| debian/screen(Debian:14) | < 4.5.0-3 | 4.5.0-3 |
| GNU screen | <= 4.5.0 | No fix listed |
| alpine/screen(Alpine:v3.5) | < 4.5.1 | 4.5.1 |
References
- Debian Security Tracker CVE-2017-5618 vendor-advisory
- git.savannah.gnu.org patch third-party-advisory
- git.savannah.gnu.org release-notes third-party-advisory
- savannah.gnu.org third-party-advisory
- [oss-security] 20170129 Re: CVE request: GNU screen escalation exploit mailing-list third-party-advisory
- 95873 third-party-advisory vdb-entry
- [screen-devel] 20170124 [bug #50142] root exploit 4.5.0 exploit mailing-list third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking