Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function     (CVE-2017-10685)

  - In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of     tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is     used to process untrusted terminfo data. (CVE-2017-11112)

  - In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of     tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is     used to process untrusted terminfo data. (CVE-2017-11113)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function     (CVE-2017-10685)

  - In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of     tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is     used to process untrusted terminfo data. (CVE-2017-11112)

  - In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of     tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is     used to process untrusted terminfo data. (CVE-2017-11113)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function     (CVE-2017-10685)

  - In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will     lead to a remote arbitrary code execution attack. (CVE-2017-10684)

  - In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of     tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is     used to process untrusted terminfo data. (CVE-2017-11112)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5477-1 advisory.

    Hosein Askari discovered that ncurses was incorrectly performing memory management operations when dealing     with long filenames while writing structures into the file system. An attacker could possibly use this     issue to cause a denial of service or execute arbitrary code. (CVE-2017-16879)

    Chung-Yi Lin discovered that ncurses was incorrectly handling access to invalid memory areas when parsing     terminfo or termcap entries where the use-name had invalid syntax. An attacker could possibly use this     issue to cause a denial of service. (CVE-2018-19211)

    It was discovered that ncurses was incorrectly performing bounds checks when processing invalid hashcodes.
    An attacker could possibly use this issue to cause a denial of service or to expose sensitive information.
    (CVE-2019-17594)

    It was discovered that ncurses was incorrectly handling end-of-string characters when processing terminfo     and termcap files. An attacker could possibly use this issue to cause a denial of service or to expose     sensitive information. (CVE-2019-17595)

    It was discovered that ncurses was incorrectly handling end-of-string characters when converting between     termcap and terminfo formats. An attacker could possibly use this issue to cause a denial of service or     execute arbitrary code. (CVE-2021-39537)

    It was discovered that ncurses was incorrectly performing bounds checks when dealing with corrupt terminfo     data while reading a terminfo file. An attacker could possibly use this issue to cause a denial of service     or to expose sensitive information. (CVE-2022-29458)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ncurses package has been released.

The remote host is affected by the vulnerability described in GLSA-201804-13 (ncurses: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ncurses. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing the user to process untrusted terminfo or       other data, could execute arbitrary code or cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Stack-based buffer overflow in the _nc_write_entry     function in tinfo/write_entry.c in ncurses 6.0 allows     attackers to cause a denial of service (application     crash) or possibly execute arbitrary code via a crafted     terminfo file, as demonstrated by tic.(CVE-2017-16879)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ncurses fixes the following issues: Security issues fixed :

  - CVE-2017-13728: Fix infinite loop in the next_char     function in comp_scan.c (bsc#1056136).

  - CVE-2017-13729: Fix illegal address access in the
    _nc_save_str (bsc#1056132).

  - CVE-2017-13730: Fix illegal address access in the     function _nc_read_entry_source() (bsc#1056131).

  - CVE-2017-13731: Fix illegal address access in the     function postprocess_termcap() (bsc#1056129).

  - CVE-2017-13732: Fix illegal address access in the     function dump_uses() (bsc#1056128).

  - CVE-2017-13733: Fix illegal address access in the     fmt_entry function (bsc#1056127).

  - CVE-2017-16879: Fix stack-based buffer overflow in the
    _nc_write_entry() function (bsc#1069530).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198984	RHEL 6 : ncurses (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198914	RHEL 5 : ncurses (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198896	RHEL 7 : ncurses (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196719	RHEL 7 : ncurses (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196713	RHEL 5 : ncurses (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196707	RHEL 6 : ncurses (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
162173	Ubuntu 16.04 ESM : ncurses vulnerabilities (USN-5477-1)	Nessus	Ubuntu Local Security Checks	high
121781	Photon OS 1.0: Ncurses PHSA-2017-1.0-0093	Nessus	PhotonOS Local Security Checks	high
121777	Photon OS 2.0: Ncurses PHSA-2017-0053	Nessus	PhotonOS Local Security Checks	high
109097	GLSA-201804-13 : ncurses: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
106147	EulerOS 2.0 SP2 : ncurses (EulerOS-SA-2018-1006)	Nessus	Huawei Local Security Checks	high
106146	EulerOS 2.0 SP1 : ncurses (EulerOS-SA-2018-1005)	Nessus	Huawei Local Security Checks	high
104993	SUSE SLES11 Security Update : ncurses (SUSE-SU-2017:3183-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-16879

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high

critical

high

high

high