A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A malicious terminal device could potentially use this flaw to crash minicom, or execute arbitrary code in the context of the minicom process.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A buffer overflow flaw was found in the way minicom before version 2.7.1 handled VT100 escape sequences. A     malicious terminal device could potentially use this flaw to crash minicom, or execute arbitrary code in     the context of the minicom process. (CVE-2017-7467)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the minicom package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A buffer overflow flaw was found in the way minicom     before version 2.7.1 handled VT100 escape sequences. A     malicious terminal device could potentially use this     flaw to crash minicom, or execute arbitrary code in the     context of the minicom process.(CVE-2017-7467)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for minicom fixes the following issue :

This security issue was fixed :

  - CVE-2017-7467: Invalid cursor coordinates and scroll     regions could lead to code execution (bsc#1033783).

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is affected by the vulnerability described in GLSA-201706-13 (minicom: Remote execution of arbitrary code)

    In minicom before version 2.7.1, the escparms[] buffer in vt100.c is       vulnerable to an overflow.
  Impact :

    A remote attacker, able to connect to a minicom port, could possibly       execute arbitrary code with the privileges of the process, or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for minicom fixes the following issues :

  - CVE-2017-7467: Invalid cursor coordinates and scroll     regions could lead to code execution (bsc#1033783)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-7467 Out of bounds write in vt100.c

For Debian 7 'Wheezy', these problems have been fixed in version 2.6.1-1+deb7u1.

We recommend that you upgrade your minicom packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for minicom fixes the following issue: This security issue was fixed :

  - CVE-2017-7467: Invalid cursor coordinates and scroll     regions could lead to code execution (bsc#1033783).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New minicom packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

ID	Name	Product	Family	Severity
221298	Linux Distros Unpatched Vulnerability : CVE-2017-7467	Nessus	Misc.	critical
146645	EulerOS 2.0 SP2 : minicom (EulerOS-SA-2021-1329)	Nessus	Huawei Local Security Checks	critical
146186	EulerOS 2.0 SP5 : minicom (EulerOS-SA-2021-1214)	Nessus	Huawei Local Security Checks	critical
145174	EulerOS 2.0 SP3 : minicom (EulerOS-SA-2021-1097)	Nessus	Huawei Local Security Checks	critical
102563	openSUSE Security Update : minicom (openSUSE-2017-947)	Nessus	SuSE Local Security Checks	critical
100656	GLSA-201706-13 : minicom: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
99759	SUSE SLES11 Security Update : minicom (SUSE-SU-2017:1136-1)	Nessus	SuSE Local Security Checks	critical
99639	Debian DLA-914-1 : minicom security update	Nessus	Debian Local Security Checks	critical
99623	SUSE SLED12 / SLES12 Security Update : minicom (SUSE-SU-2017:1092-1)	Nessus	SuSE Local Security Checks	critical
99441	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : minicom (SSA:2017-108-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-7467

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical