The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

According to the version of the screen package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The MScrollV function in ansi.c in GNU screen 4.3.1 and     earlier does not properly limit recursion, which allows     remote attackers to cause a denial of service (stack     consumption) via an escape sequence with a large repeat     count value.(CVE-2015-6806)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for screen fixes the following issues :

Security issue fixed :

  - CVE-2015-6806: Fixed a stack overflow due to deep     recursion (bsc#944458).

Non-security issue fixed :

  - Fixed segmentation faults related to altscreen and     resizing screen (bsc#1130831).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Kuang-che Wu discovered that GNU Screen improperly handled certain input. An attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service or the execution of arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for screen fixes the following issues :

Security issue fixed :

CVE-2015-6806: Fixed a stack overflow due to deep recursion (bsc#944458).

Non-security issue fixed: Fixed segmentation faults related to altscreen and resizing screen (bsc#1130831).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kuang-che Wu reports :

screen will recursively call MScrollV to depth n/256. This is time consuming and will overflow stack if n is huge.

A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service.

A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service.

See DSA-3352-1 for information on other Debian releases.

We recommend that you upgrade your screen packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
135562	EulerOS 2.0 SP3 : screen (EulerOS-SA-2020-1433)	Nessus	Huawei Local Security Checks	high
131822	EulerOS 2.0 SP5 : screen (EulerOS-SA-2019-2548)	Nessus	Huawei Local Security Checks	medium
125670	openSUSE Security Update : screen (openSUSE-2019-1485)	Nessus	SuSE Local Security Checks	medium
125594	Ubuntu 14.04 LTS : GNU Screen vulnerability (USN-3996-1)	Nessus	Ubuntu Local Security Checks	medium
125468	SUSE SLED12 / SLES12 Security Update : screen (SUSE-SU-2019:1354-1)	Nessus	SuSE Local Security Checks	medium
122386	EulerOS 2.0 SP2 : screen (EulerOS-SA-2019-1059)	Nessus	Huawei Local Security Checks	medium
85860	FreeBSD : screen -- stack overflow (98092444-5645-11e5-9ad8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
85809	Debian DSA-3352-1 : screen - security update	Nessus	Debian Local Security Checks	medium
85807	Debian DLA-305-1 : screen security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-6806

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium