Critical Stack-Based Buffer Overflow in ncurses Package
Summary
ALPINE-CVE-2017-10684: In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. Affects ncurses versions < 6.0_p20170701-r0. Fixed in 6.0_p20170701-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ncurses package is a widely used library that provides functions to create text-based user interfaces in a terminal. It allows developers to manage multiple windows, handle keyboard input, and manipulate text display. This library is essential for applications that require a robust terminal interface. However, a critical vulnerability has been identified that could allow attackers to exploit this library, leading to severe security risks.
Vulnerability Detail
In ncurses version 6.0, a stack-based buffer overflow exists in the fmt_entry function. This vulnerability arises from improper handling of crafted input, which can lead to remote arbitrary code execution. If exploited, an attacker could potentially gain control over the affected system, execute malicious code, and compromise sensitive data. The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
How To Fix
Minimum fixed version
6.0_p20170701-r0
This is the first release that contains the fix.
sudo apk add --upgrade ncursesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to applications that utilize the ncurses library until the package is updated. Additionally, validate and sanitize all user inputs to mitigate the risk of exploitation.
Conclusion
The ncurses package has a critical vulnerability that could lead to severe security risks if left unaddressed. It is crucial to update to the patched version to protect your systems. Utilize tools like Vulert to monitor for vulnerabilities and ensure your applications remain secure.
See every vulnerability recorded for ncurses →
FAQ
The vulnerability is a stack-based buffer overflow in the fmt_entry function, which can lead to remote arbitrary code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, attackers could execute arbitrary code, gain control over the system, and compromise sensitive information.
Yes, the patched version of ncurses is 6.0_p20170701-r0 for Alpine Linux. Updating to this version will resolve the vulnerability.
As a temporary measure, restrict access to applications using ncurses and validate user inputs to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ncurses.
