screen 4.0.3 Local Authentication Bypass Vulnerability

🗓️ 05 Jun 2007 00:00:00Reported by RootType
screen 4.0.3 Local Authentication Bypass Vulnerability & Personal note on request for deescalatio

                                                &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;_____&nbsp;_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;___&nbsp;_____&nbsp;_&nbsp;&nbsp;&nbsp;_
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;/&nbsp;/&nbsp;____/&nbsp;/&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;_/_&nbsp;&nbsp;__/&nbsp;/&nbsp;/&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/_/&nbsp;/&nbsp;__/&nbsp;/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;&nbsp;/&nbsp;/&nbsp;/&nbsp;/_/&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;__&nbsp;&nbsp;/&nbsp;/___/&nbsp;/____/&nbsp;/&nbsp;&nbsp;/&nbsp;/&nbsp;/&nbsp;__&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_/&nbsp;/_/_____/_____/___/&nbsp;/_/&nbsp;/_/&nbsp;/_/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Helith&nbsp;-&nbsp;0815
--------------------------------------------------------------------------------


Author:&nbsp;Rembrandt
Date:&nbsp;Known&nbsp;since&nbsp;somewhere&nbsp;in&nbsp;&amp;cant_remember
Affected&nbsp;Software:&nbsp;screen&nbsp;&lt;=&nbsp;4.0.3
Type:&nbsp;Local
Type:&nbsp;Authentication&nbsp;Bypass

Greets&nbsp;go&nbsp;to:&nbsp;Helith&nbsp;and&nbsp;all&nbsp;affiliated&nbsp;People,&nbsp;t3c0,&nbsp;levent,&nbsp;str0ke,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;hdm,&nbsp;The&nbsp;EOF-Crew,&nbsp;rrlf,&nbsp;herm1t,&nbsp;Solar&nbsp;Designer,&nbsp;softxor,
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Packetstorm,&nbsp;FeFe,&nbsp;kscope,&nbsp;Zarathu,&nbsp;f0rg3,&nbsp;Mr.&nbsp;Joern&nbsp;Alles

Disrespect&nbsp;goes&nbsp;to:&nbsp;A&nbsp;Bank&nbsp;[/]
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;And&nbsp;others&nbsp;included&nbsp;into&nbsp;this&nbsp;case...

Personal&nbsp;note:&nbsp;I&nbsp;wanna&nbsp;get&nbsp;MY&nbsp;STUFF&nbsp;BACK!
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;is&nbsp;the&nbsp;last&nbsp;&quot;diplomatic&quot;&nbsp;attemp&nbsp;made&nbsp;directly.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Contact&nbsp;me&nbsp;if&nbsp;you`re&nbsp;interested&nbsp;into&nbsp;a&nbsp;deescalation.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nobody&nbsp;is&nbsp;interested&nbsp;into&nbsp;making&nbsp;the&nbsp;things&nbsp;even&nbsp;more&nbsp;complicated
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;or?&nbsp;So&nbsp;make&nbsp;your&nbsp;choice.&nbsp;And&nbsp;you&nbsp;better&nbsp;hurry...
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;And&nbsp;this&nbsp;is&nbsp;no&nbsp;blackmailing&nbsp;attemp&nbsp;but&nbsp;others&nbsp;may&nbsp;decide&nbsp;for&nbsp;you
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;you&nbsp;don`t&nbsp;do&nbsp;it.
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;IMPORTENT:&nbsp;Turn&nbsp;your&nbsp;brain&nbsp;&quot;ON&quot;&nbsp;this&nbsp;time.
--------------------------------------------------------------------------------

I&nbsp;didn`t&nbsp;found&nbsp;a&nbsp;Adv.&nbsp;related&nbsp;to&nbsp;this&nbsp;so&nbsp;I&nbsp;decided&nbsp;to&nbsp;write&nbsp;one.&nbsp;:]

screen&nbsp;is&nbsp;vulnerable&nbsp;to&nbsp;a&nbsp;authentication&nbsp;bypass&nbsp;which&nbsp;allows&nbsp;local&nbsp;attackers
to&nbsp;gain&nbsp;system&nbsp;access&nbsp;in&nbsp;case&nbsp;screen&nbsp;was&nbsp;locked&nbsp;with&nbsp;a&nbsp;Password.

It&nbsp;has&nbsp;been&nbsp;tested&nbsp;on&nbsp;OpenBSD&nbsp;4.1&nbsp;+&nbsp;screen&nbsp;4.0.3&nbsp;on&nbsp;x86.

How&nbsp;to&nbsp;reproduce:

Lock&nbsp;screen&nbsp;using&nbsp;ctrl+x
Choose&nbsp;a&nbsp;Password
Confirm&nbsp;the&nbsp;Password

Screen&nbsp;asks&nbsp;for&nbsp;a&nbsp;Password&nbsp;to&nbsp;unlock&nbsp;the&nbsp;screen.
Just&nbsp;press&nbsp;ctrl+c.
2&nbsp;seconds&nbsp;later&nbsp;the&nbsp;screen&nbsp;is&nbsp;unlocked&nbsp;and&nbsp;you`ve&nbsp;access.


Have&nbsp;fun!
05 Jun 2007 00:00Current
7.1High risk
Vulners AI Score7.1
screen vulnerability authentication bypass personal note request deescalation