Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5477-1 advisory.

    Hosein Askari discovered that ncurses was incorrectly performing memory management operations when dealing     with long filenames while writing structures into the file system. An attacker could possibly use this     issue to cause a denial of service or execute arbitrary code. (CVE-2017-16879)

    Chung-Yi Lin discovered that ncurses was incorrectly handling access to invalid memory areas when parsing     terminfo or termcap entries where the use-name had invalid syntax. An attacker could possibly use this     issue to cause a denial of service. (CVE-2018-19211)

    It was discovered that ncurses was incorrectly performing bounds checks when processing invalid hashcodes.
    An attacker could possibly use this issue to cause a denial of service or to expose sensitive information.
    (CVE-2019-17594)

    It was discovered that ncurses was incorrectly handling end-of-string characters when processing terminfo     and termcap files. An attacker could possibly use this issue to cause a denial of service or to expose     sensitive information. (CVE-2019-17595)

    It was discovered that ncurses was incorrectly handling end-of-string characters when converting between     termcap and terminfo formats. An attacker could possibly use this issue to cause a denial of service or     execute arbitrary code. (CVE-2021-39537)

    It was discovered that ncurses was incorrectly performing bounds checks when dealing with corrupt terminfo     data while reading a terminfo file. An attacker could possibly use this issue to cause a denial of service     or to expose sensitive information. (CVE-2022-29458)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ncurses package has been released.

An update of 'linux', 'krb5', 'subversion', 'apr', 'ncurses' packages of Photon OS has been released.

An update of [apr,ncurses] packages for PhotonOS has been released.

The remote host is affected by the vulnerability described in GLSA-201804-13 (ncurses: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ncurses. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing the user to process untrusted terminfo or       other data, could execute arbitrary code or cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

According to the version of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Stack-based buffer overflow in the _nc_write_entry     function in tinfo/write_entry.c in ncurses 6.0 allows     attackers to cause a denial of service (application     crash) or possibly execute arbitrary code via a crafted     terminfo file, as demonstrated by tic.(CVE-2017-16879)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ncurses fixes the following issues: Security issues fixed :

  - CVE-2017-13728: Fix infinite loop in the next_char     function in comp_scan.c (bsc#1056136).

  - CVE-2017-13729: Fix illegal address access in the
    _nc_save_str (bsc#1056132).

  - CVE-2017-13730: Fix illegal address access in the     function _nc_read_entry_source() (bsc#1056131).

  - CVE-2017-13731: Fix illegal address access in the     function postprocess_termcap() (bsc#1056129).

  - CVE-2017-13732: Fix illegal address access in the     function dump_uses() (bsc#1056128).

  - CVE-2017-13733: Fix illegal address access in the     fmt_entry function (bsc#1056127).

  - CVE-2017-16879: Fix stack-based buffer overflow in the
    _nc_write_entry() function (bsc#1069530).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
162173	Ubuntu 16.04 ESM : ncurses vulnerabilities (USN-5477-1)	Nessus	Ubuntu Local Security Checks	high
121781	Photon OS 1.0: Ncurses PHSA-2017-1.0-0093	Nessus	PhotonOS Local Security Checks	high
121777	Photon OS 2.0: Ncurses PHSA-2017-0053	Nessus	PhotonOS Local Security Checks	high
111903	Photon OS 1.0: Apr / Krb5 / Linux / Ncurses / Subversion PHSA-2017-1.0-0093 (deprecated)	Nessus	PhotonOS Local Security Checks	critical
111902	Photon OS 2.0: Apr / Ncurses PHSA-2017-0053 (deprecated)	Nessus	PhotonOS Local Security Checks	high
109097	GLSA-201804-13 : ncurses: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
106147	EulerOS 2.0 SP2 : ncurses (EulerOS-SA-2018-1006)	Nessus	Huawei Local Security Checks	high
106146	EulerOS 2.0 SP1 : ncurses (EulerOS-SA-2018-1005)	Nessus	Huawei Local Security Checks	high
104993	SUSE SLES11 Security Update : ncurses (SUSE-SU-2017:3183-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-16879

high

Tenable Plugins

high

high

high

critical

high

critical

high

high

high