CVE-2001-1012 in screen
Summary
by MITRE
Vulnerability in screen before 3.9.10, related to a multi-attach error, allows local users to gain root privileges when there is a subdirectory under /tmp/screens/.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/08/2019
The vulnerability identified as CVE-2001-1012 represents a critical privilege escalation flaw within the screen terminal multiplexer software prior to version 3.9.10. This vulnerability specifically exploits a multi-attach error condition that occurs when screen attempts to manage multiple attachments to a session, creating a scenario where local users can potentially escalate their privileges to root access. The flaw is particularly dangerous because it leverages the presence of subdirectories within the /tmp/screens/ directory structure, which serves as a temporary storage location for screen session files and associated metadata.
The technical implementation of this vulnerability stems from improper handling of file permissions and directory management within the screen application's session attachment mechanism. When screen processes multiple attachments to a session, it fails to properly validate the security context of subdirectories within the /tmp/screens/ path. This error condition allows a local attacker to manipulate the file system structure in such a way that they can create or modify files with elevated privileges, ultimately leading to root access. The vulnerability is classified as a privilege escalation issue under CWE-269, which specifically addresses the creation of improper privileges during the execution of a program.
The operational impact of CVE-2001-1012 is significant for systems running vulnerable versions of screen, as it provides a straightforward path for local users to gain administrative control over affected systems. Attackers can exploit this vulnerability by creating malicious subdirectories within /tmp/screens/ and then triggering the multi-attach scenario, which causes screen to process these directories with insufficient security checks. This exploitation method aligns with ATT&CK technique T1068, which focuses on local privilege escalation through the exploitation of system vulnerabilities. The vulnerability is particularly concerning in multi-user environments where screen is commonly used for session management and remote access.
Systems that are vulnerable to this exploit typically include Unix and Linux environments where screen is installed and used for terminal multiplexing, especially in scenarios where multiple users share the same system or where screen sessions are managed with elevated privileges. The exploitation requires local access to the system and knowledge of the screen application's behavior, making it less likely to be exploited remotely but still highly dangerous in environments where local access is possible. Organizations should immediately implement mitigations including updating screen to version 3.9.10 or later, implementing proper file system permissions for /tmp/screens/ directories, and monitoring for unauthorized modifications to these critical paths. The vulnerability also highlights the importance of proper input validation and privilege separation in system utilities, as outlined in security best practices for Unix-like systems.