Security Update for screen
Summary
DSA-3352-1: screen - security update. Affects screen versions < 4.1.0~20120320gitdb59704-7+deb7u1. Fixed in 4.1.0~20120320gitdb59704-7+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
screen is a terminal multiplexer that allows multiple sessions to be created and accessed from a single terminal. It provides features such as session sharing, detachable sessions, and session persistence. The screen server process is responsible for managing these sessions. However, a vulnerability has been discovered in screen that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability in screen is due to a stack overflow issue. An attacker can exploit this vulnerability by sending specially crafted input to the screen server process, causing it to crash. This can result in a DoS condition, rendering the screen sessions inaccessible. The vulnerability has been assigned the identifier CVE-2015-6806.
How To Fix
Minimum fixed version
4.1.0~20120320gitdb59704-7+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade screenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The screen package has been found to have a vulnerability that can lead to a denial of service (DoS) attack. To mitigate this risk, it is crucial to update the screen package to the fixed versions mentioned above. Failure to do so may result in the screen server process crashing and rendering the screen sessions inaccessible. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for screen →
FAQ
Screen is a terminal multiplexer that allows multiple sessions to be created and accessed from a single terminal. It provides features such as session sharing, detachable sessions, and session persistence.
A stack overflow occurs when a program's call stack exceeds its allocated memory space. In the case of screen, this vulnerability allows an attacker to send specially crafted input that triggers a stack overflow in the screen server process.
A denial of service (DoS) attack is an attempt to make a computer or network resource unavailable to its intended users. In the case of this vulnerability, exploiting it can cause the screen server process to crash, rendering the screen sessions inaccessible.
You can use tools like Vulert (https://vulert.com) to check if your screen package is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the patched version of the screen package.
Related vulnerabilities
Recent vulnerabilities recorded for screen.
