Buffer Overflow Vulnerability in ncurses Package: Denial of Service Risk
Summary
CVE-2020-19188: Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. Affects ncurses across 2 version ranges.
< 6.1+20191019-1
< 1713400c1c9b80cb7cb9d204acb0525dc592b07d
Fixed in 6.1+20191019-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ncurses package is a widely used library that provides functions to create text-based user interfaces in a terminal. It supports various features such as color manipulation, window management, and keyboard input handling. This package is essential for many applications that require a user-friendly command-line interface. However, a buffer overflow vulnerability has been identified in the fmt_entry function, which could allow attackers to exploit the library and cause a denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2020-19188, originates from a buffer overflow in the fmt_entry function located in progs/dump_entry.c at line 1116. This flaw allows remote attackers to craft specific commands that can overflow the buffer, potentially leading to a denial of service. The technical implications include the possibility of crashing the application or causing unexpected behavior, which can disrupt services relying on ncurses.
How To Fix
Minimum fixed version
6.1+20191019-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ncursesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the specific functionalities of the ncurses package that invoke the fmt_entry function until the package is updated. Additionally, restricting access to the application using ncurses can mitigate the risk of exploitation.
Conclusion
The buffer overflow vulnerability in the ncurses package poses a significant risk of denial of service. Users are strongly advised to update their ncurses installations to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for ncurses →
FAQ
CVE-2020-19188 is a buffer overflow vulnerability in the ncurses package that can lead to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The primary consequence is a denial of service, which can disrupt applications that rely on the ncurses library.
Yes, updating the ncurses package to version 6.1+20191019-1 or later will permanently fix the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for ncurses.
