Headline
Ubuntu Security Notice USN-6198-1
Ubuntu Security Notice 6198-1 - It was discovered that GNU Screen was not properly checking user identifiers before sending certain signals to target processes. If GNU Screen was installed as setuid or setgid, a local attacker could possibly use this issue to cause a denial of service on a target application.
==========================================================================Ubuntu Security Notice USN-6198-1July 03, 2023screen vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 18.04 LTS (Available with Ubuntu Pro)- Ubuntu 16.04 LTS (Available with Ubuntu Pro)- Ubuntu 14.04 LTS (Available with Ubuntu Pro)Summary:GNU Screen could be made to crash applications if it received speciallycrafted input.Software Description:- screen: terminal multiplexer with VT100/ANSI terminal emulationDetails:It was discovered that GNU Screen was not properly checking useridentifiers before sending certain signals to target processes. If GNUScreen was installed as setuid or setgid, a local attacker could possiblyuse this issue to cause a denial of service on a target application.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 18.04 LTS (Available with Ubuntu Pro): screen 4.6.2-1ubuntu1.1+esm1Ubuntu 16.04 LTS (Available with Ubuntu Pro): screen 4.3.1-2ubuntu0.1+esm1Ubuntu 14.04 LTS (Available with Ubuntu Pro): screen 4.1.0~20120320gitdb59704-9ubuntu0.1~esm3In general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-6198-1 CVE-2023-24626Related news
CVE-2023-24626
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process.