screen 4.0.3 Local Authentication Bypass Vulnerability (OpenBSD)

🗓️ 19 Jun 2008 00:00:00Reported by RootType
Screen 4.0.3 Local Authentication Bypass Vulnerability on OpenBSD. Allows local attackers to gain system access by bypassing password-protected screen lock

                                                &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;_____&nbsp;_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;___&nbsp;_____&nbsp;_&nbsp;&nbsp;&nbsp;_
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;/&nbsp;/&nbsp;____/&nbsp;/&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;_/_&nbsp;&nbsp;__/&nbsp;/&nbsp;/&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/_/&nbsp;/&nbsp;__/&nbsp;/&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;/&nbsp;&nbsp;/&nbsp;/&nbsp;/&nbsp;/_/&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;__&nbsp;&nbsp;/&nbsp;/___/&nbsp;/____/&nbsp;/&nbsp;&nbsp;/&nbsp;/&nbsp;/&nbsp;__&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_/&nbsp;/_/_____/_____/___/&nbsp;/_/&nbsp;/_/&nbsp;/_/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Helith&nbsp;-&nbsp;0815
--------------------------------------------------------------------------------

Author:&nbsp;Rembrandt
Date&nbsp;&nbsp;:&nbsp;Known&nbsp;since&nbsp;somewhere&nbsp;in&nbsp;&amp;cant_remember&nbsp;(some&nbsp;years,&nbsp;realy..)
Affected&nbsp;Software:&nbsp;screen&nbsp;&lt;=&nbsp;4.0.3
Affected&nbsp;OS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;OpenBSD&nbsp;(any&nbsp;up&nbsp;to&nbsp;current&nbsp;(wich&nbsp;will&nbsp;become&nbsp;oBSD&nbsp;4.4))
Type:&nbsp;Local
Type:&nbsp;Authentication&nbsp;Bypass

Greets&nbsp;go&nbsp;to:&nbsp;Helith&nbsp;and&nbsp;all&nbsp;affiliated/loyal&nbsp;people&nbsp;


I&nbsp;did&nbsp;not&nbsp;found&nbsp;a&nbsp;Advisory&nbsp;related&nbsp;to&nbsp;this&nbsp;so&nbsp;I&nbsp;decided&nbsp;to&nbsp;write&nbsp;a&nbsp;leet&nbsp;one.

screen&nbsp;is&nbsp;vulnerable&nbsp;to&nbsp;a&nbsp;authentication&nbsp;bypass&nbsp;which&nbsp;allows&nbsp;local&nbsp;attackers
to&nbsp;gain&nbsp;system&nbsp;access&nbsp;in&nbsp;case&nbsp;screen&nbsp;was&nbsp;locked&nbsp;with&nbsp;a&nbsp;password.

It&nbsp;has&nbsp;been&nbsp;tested&nbsp;on&nbsp;OpenBSD&nbsp;+&nbsp;screen&nbsp;4.0.3&nbsp;on&nbsp;x86/amd64.
But&nbsp;during&nbsp;the&nbsp;nature&nbsp;of&nbsp;the&nbsp;behavior&nbsp;of&nbsp;screen&nbsp;and&nbsp;OpenBSD&nbsp;it&nbsp;should&nbsp;be
architecture/version&nbsp;indipendent&nbsp;for&nbsp;now.


How&nbsp;to&nbsp;check&nbsp;this?

Lock&nbsp;screen&nbsp;using&nbsp;ctrl+x
Choose&nbsp;a&nbsp;Password
Confirm&nbsp;the&nbsp;Password

Screen&nbsp;asks&nbsp;for&nbsp;a&nbsp;Password&nbsp;to&nbsp;unlock&nbsp;the&nbsp;screen.
Just&nbsp;press&nbsp;ctrl+c&nbsp;and&nbsp;if&nbsp;you&nbsp;like&nbsp;screen-x&nbsp;to&nbsp;reattach&nbsp;the&nbsp;screen-session.

Example:

$&nbsp;testscreen
/bin/ksh:&nbsp;testscreen:&nbsp;not&nbsp;found
$
Key:
Again:
Screen&nbsp;used&nbsp;by&nbsp;rembrandt&nbsp;&lt;rembrandt&gt;.
Password:&nbsp;&lt;ctrl-c&nbsp;here&gt;
$&nbsp;screen&nbsp;-x
There&nbsp;are&nbsp;several&nbsp;suitable&nbsp;screens&nbsp;on:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;29602.ttyC0.raven&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(Attached)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;25144.ttyC1.raven&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(Detached)
Type&nbsp;&quot;screen&nbsp;[-d]&nbsp;-r&nbsp;[pid.]tty.host&quot;&nbsp;to&nbsp;resume&nbsp;one&nbsp;of&nbsp;them.
$&nbsp;screen&nbsp;-x&nbsp;25144
$&nbsp;testscreen
/bin/ksh:&nbsp;testscreen:&nbsp;not&nbsp;found
$&nbsp;

Because&nbsp;of&nbsp;the&nbsp;nature&nbsp;of&nbsp;a&nbsp;locked&nbsp;screen&nbsp;you&nbsp;wont&nbsp;be&nbsp;able&nbsp;to&nbsp;lock&nbsp;your&nbsp;shell.
screen&nbsp;will&nbsp;never&nbsp;ask&nbsp;you&nbsp;for&nbsp;a&nbsp;password.

Of&nbsp;course&nbsp;this&nbsp;works&nbsp;also&nbsp;if&nbsp;you&nbsp;get&nbsp;access&nbsp;to&nbsp;a&nbsp;SSH&nbsp;wich&nbsp;has&nbsp;a&nbsp;locked
screen&nbsp;running.&nbsp;So&nbsp;in&nbsp;case&nbsp;you&nbsp;have&nbsp;locked&nbsp;your&nbsp;screen&nbsp;session&nbsp;wich&nbsp;contains
a&nbsp;open&nbsp;SSH&nbsp;session&nbsp;to&nbsp;a&nbsp;host&nbsp;where&nbsp;you&nbsp;also&nbsp;have&nbsp;a&nbsp;locked&nbsp;screen&nbsp;session
you&nbsp;might&nbsp;have&nbsp;no&nbsp;password&nbsp;protection&nbsp;at&nbsp;all&nbsp;in&nbsp;case&nbsp;all&nbsp;systems&nbsp;are&nbsp;OpenBSD.
That&nbsp;is&nbsp;just&nbsp;another&nbsp;example.&nbsp;Importent&nbsp;for&nbsp;you&nbsp;should&nbsp;be&nbsp;the&nbsp;combination&nbsp;of
screen&nbsp;and&nbsp;OpenBSD.

Do&nbsp;not&nbsp;claim&nbsp;it&nbsp;does&nbsp;not&nbsp;work&nbsp;because&nbsp;you&nbsp;just&nbsp;tested&nbsp;this&nbsp;against&nbsp;the&nbsp;latest
Linux/Solaris/Whatever.

It&nbsp;is&nbsp;known&nbsp;to&nbsp;work&nbsp;and&nbsp;I&nbsp;mentioned&nbsp;the&nbsp;OS.
Still&nbsp;it&nbsp;is&nbsp;known&nbsp;that&nbsp;it&nbsp;worked&nbsp;against&nbsp;some&nbsp;scarry&nbsp;Linux&nbsp;distributions
wich&nbsp;are&nbsp;not&nbsp;realy&nbsp;common.

All&nbsp;security&nbsp;websites&nbsp;wich&nbsp;do&nbsp;report&nbsp;this&nbsp;is&nbsp;a&nbsp;fake&nbsp;may&nbsp;consider&nbsp;to&nbsp;update&nbsp;their
reports&nbsp;except&nbsp;of&nbsp;simply&nbsp;claiming&nbsp;wrong&nbsp;things.

Have&nbsp;fun!


Kind&nbsp;regards,
Rembrandt
19 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1