Stack-based buffer overflow in ncurses - CVE-2017-16879

Vulnerability identifier: #VU12202

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-16879

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists in the _nc_write_entry function in tinfo/write_entry.c due to stac-based buffer overflow. A remote attacker can submit a specially crafted terminfo file, as demonstrated by tic, trick the victim into opening it, trigger memory corruption and cause the service to crash or execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

ncurses
Isolation Segment
VMware Tanzu Application Service for VMs
Gentoo Linux
SUSE Linux
Ubuntu
Tanzu Greenplum for Kubernetes
VMware Tanzu Operations Manager
ncurses (Alpine package)
libtinfo5 (Ubuntu package)
ncurses-bin (Ubuntu package)
libncurses5 (Ubuntu package)

Update to version 6.1.

Tanzu Greenplum for Kubernetes - update to 2.0.0
VMware Tanzu Operations Manager - addressed in versions 2.9.41, 2.10.44
ncurses (Alpine package) - update to 6.0_p20171125-r0
libtinfo5 (Ubuntu package) - update to 6.0+201602131ubuntu1+esm2
ncurses-bin (Ubuntu package) - update to 6.0+201602131ubuntu1+esm2
libncurses5 (Ubuntu package) - update to 6.0+201602131ubuntu1+esm2

• http://invisible-island.net/ncurses/NEWS.html#t20171125

• Gentoo update for ncurses
• SUSE Linux update for ncurses
• Stack-based buffer overflow in ncurses (Alpine package)
• Ubuntu update for ncurses
• VMware Tanzu products update for ncurses