GNU screen 本地用户解除屏幕的锁定漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1115478 漏洞类型 未知
发布时间 2008-06-18 更新时间 2008-06-18
CVE编号 CVE-2007-3048 CNNVD-ID CNNVD-200706-047
漏洞平台 Linux CVSS评分 7.2
|漏洞来源
https://www.exploit-db.com/exploits/4028
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200706-047
|漏洞详情
**有争议的**GNUscreen4.0.3版本允许本地用户借助密码提示上的CTRL-C序列,解除屏幕的锁定。
|漏洞EXP
_   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author		 : Rembrandt
Date		 : 2007-06-03
Affected Software: screen <= 4.0.3
Affected OS	 : OpenBSD up to 4.4 (and propably others)
Type		 : Local Authentication Bypass

OSVDB		 : 39587
Milw0rm		 : 4028
CVE		 : 2007-3048
ISS X-Force:	 : 34693

screen, on some operating systems, is vulnerable to a local terminal screen 
lock authentication bypass that may allow physically proximate attackers to 
gain access to the system.

This issue has been confirmed on OpenBSD with screen 4.0.3 on x86/amd64.
The underlying vulnerability may be related to 3rd party authentication such
as PAM. This issue was tested on OpenSuSE with screen 4.0.2 and was not
vulnerable.


Steps to reproduce:

$ screen -S test
[Screened session starts]
$ id
uid=1001(test) gid=1001(test) groups=1001(test)
$ 
[type  ctrl-a x]
Key:  test
Again:  test
Screen used by test <test>.
Password:
[type  ctrl-c]
$ screen -r
[Regained access to screen, without password]

The screen lock mechanism is designed to lock a terminal, not the entire shell 
session. If an attacker has shell access to the target account, it is understood
they can bypass protection. However, on the system tested, the screen lock
mechanism was bypassed using 'ctrl-c'.

The vulnerability is not in OpenBSD. screen developers indicate this is known
behavior, but do not appear to fully understand the scenario with which 
this can be abused. Replies to my initial disclosure suggest this may be
related to PAM authentication, or another 3rd party package. Testing was
not performed to fully identify the vulnerable code.

Tobias Ulmer has committed a patch to the screen code that prevents
this exploit from happening.


Kind regards,
Rembrandt

# milw0rm.com [2008-06-18]
|参考资料

来源:XF
名称:screen-password-authentication-bypass(34693)
链接:http://xforce.iss.net/xforce/xfdb/34693
来源:FULLDISC
名称:20070604screen4.0.3localAuthenticationBypass
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063728.html
来源:FULLDISC
名称:20070604screen4.0.3localAuthenticationBypass
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063721.html
来源:FULLDISC
名称:20070604screen4.0.3localAuthenticationBypass
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063710.html
来源:FULLDISC
名称:20070604screen4.0.3localAuthenticationBypass
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063706.html