CVE-2017-5618
UnknownEPSS 1.09%
Last modified
CVE-2017-5618 is a vulnerability of currently unknown severity. GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.. EPSS estimates a 1.09% chance of exploitation in the next 30 days.
Description
GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Screen | <= 4.5.0 |
References
- http://git.savannah.gnu.org/cgit/screen.git/patch/?id=1c6d2817926d30c9a7a97d99af7ac5de4a5845b8Patch, Third Party Advisory
- http://git.savannah.gnu.org/cgit/screen.git/tree/src/ChangeLog?h=v.4.5.1Release Notes, Third Party Advisory
- http://savannah.gnu.org/bugs/?50142Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/01/29/3Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/95873Third Party Advisory, VDB Entry
- https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.htmlExploit, Third Party Advisory
- http://git.savannah.gnu.org/cgit/screen.git/patch/?id=1c6d2817926d30c9a7a97d99af7ac5de4a5845b8Patch, Third Party Advisory
- http://git.savannah.gnu.org/cgit/screen.git/tree/src/ChangeLog?h=v.4.5.1Release Notes, Third Party Advisory
- http://savannah.gnu.org/bugs/?50142Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/01/29/3Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/95873Third Party Advisory, VDB Entry
- https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-5618?
GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
How severe is CVE-2017-5618?
Severity scoring for CVE-2017-5618 is pending analysis. The EPSS model estimates a 1.09% probability of exploitation in the next 30 days.
How do I fix CVE-2017-5618?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-5612Cross-site scripting (XSS) vulnerability in wp-admin/include…
- CVE-2017-5613Format string vulnerability in cgiemail and cgiecho allows r…
- CVE-2017-5614Open redirect vulnerability in cgiemail and cgiecho allows r…6.1
- CVE-2017-5615cgiemail and cgiecho allow remote attackers to inject HTTP h…
- CVE-2017-5616Cross-site scripting (XSS) vulnerability in cgiemail and cgi…
- CVE-2017-5617The SVG Salamander (aka svgSalamander) library, when used in…7.4
- CVE-2017-5619An issue was discovered in Zammad before 1.0.4, 1.1.x before…
- CVE-2017-5620An XSS issue was discovered in Zammad before 1.0.4, 1.1.x be…
- CVE-2017-5621An issue was discovered in Zammad before 1.0.4, 1.1.x before…
- CVE-2017-5622With OxygenOS before 4.0.3, when a charger is connected to a…
- CVE-2017-5623An issue was discovered in OxygenOS before 4.1.0 on OnePlus …
- CVE-2017-5624An issue was discovered in OxygenOS before 4.0.3 for OnePlus…
Are you affected by CVE-2017-5618?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST