Remote Denial of Service Vulnerability in ncurses
Summary
CVE-2017-13734: There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack. Affects ncurses across 2 version ranges.
< 6.0_p20170701-r0
< ed3eb506e9a8e6ea871a2eb5818e19ba36f3f277
Fixed in 6.0_p20170701-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ncurses is a library that provides an API for creating text-based user interfaces in terminal applications. It is widely used in various operating systems, including Alpine Linux. The library allows developers to control the display and input of text on a terminal screen. However, a vulnerability has been discovered in ncurses version 6.0 that can lead to a remote denial of service attack.
Vulnerability Detail
The vulnerability, identified as CVE-2017-13734, is caused by an illegal address access in the _nc_safe_strcat function in strings.c. This vulnerability can be exploited remotely and may result in a denial of service attack. An attacker could send specially crafted input to a vulnerable application that uses ncurses, causing it to crash or become unresponsive. The issue arises from improper handling of certain string operations, leading to an illegal memory access.
How To Fix
Minimum fixed version
6.0_p20170701-r0
This is the first release that contains the fix.
sudo apk add --upgrade ncursesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the ncurses library.
Conclusion
The remote denial of service vulnerability in ncurses can be mitigated by updating the library to the recommended version. It is crucial for users to apply the fix promptly to prevent potential attacks. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ncurses →
FAQ
The vulnerability can lead to a remote denial of service attack, causing the affected application to crash or become unresponsive.
Yes, this vulnerability can be exploited remotely by sending specially crafted input to a vulnerable application.
Versions of ncurses up to and including 6.0 are affected by this vulnerability.
Yes, updating the ncurses library to version 6.0_p20170701-r0 or later will fix this vulnerability.
No, there are no known workarounds for this vulnerability. Updating the library is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for ncurses.
