CVE-2009-1214 - Vulnerability Details - OpenCVE

GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00084.

Key SSVC decision points have not yet been added.

Vendors	Products
Gnu	Screen

Configuration 1 [-]

cpe:2.3:a:gnu:screen:4.0.3:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2009-1213	GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123
http://savannah.gnu.org/bugs/?25296
http://www.openwall.com/lists/oss-security/2009/03/25/7
http://www.securityfocus.com/bid/34521
https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993
https://bugzilla.redhat.com/show_bug.cgi?id=492104
https://exchange.xforce.ibmcloud.com/vulnerabilities/49886
https://www.cve.org/CVERecord?id=CVE-2009-1214

History

Wed, 28 May 2025 14:45:00 +0000

Type	Values Removed	Values Added
References		https://www.cve.org/CVERecord?id=CVE-2009-1214

Thu, 22 May 2025 04:30:00 +0000

Type	Values Removed	Values Added
References	https://nvd.nist.gov/vuln/detail/CVE-2009-1214 https://www.cve.org/CVERecord?id=CVE-2009-1214

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-04-01T10:00:00

Updated: 2024-08-07T05:04:49.236Z

Reserved: 2009-03-31T00:00:00

Link: CVE-2009-1214

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-04-01T10:30:00.467

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-1214

Redhat

Severity :

Publid Date: 2009-01-11T00:00:00Z

Links: CVE-2009-1214 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-03-25T00:00:00", "descriptions": [{"lang": "en", "value": "GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"name": "screen-screenexchange-info-disclosure(49886)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49886"}, {"name": "[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"name": "34521", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/34521"}, {"tags": ["x_refsource_MISC"], "url": "http://savannah.gnu.org/bugs/?25296"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-1214", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=492104", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"name": "screen-screenexchange-info-disclosure(49886)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49886"}, {"name": "[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"name": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993", "refsource": "CONFIRM", "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123", "refsource": "CONFIRM", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"name": "34521", "refsource": "BID", "url": "http://www.securityfocus.com/bid/34521"}, {"name": "http://savannah.gnu.org/bugs/?25296", "refsource": "MISC", "url": "http://savannah.gnu.org/bugs/?25296"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T05:04:49.236Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"name": "screen-screenexchange-info-disclosure(49886)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49886"}, {"name": "[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"name": "34521", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/34521"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://savannah.gnu.org/bugs/?25296"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-1214", "datePublished": "2009-04-01T10:00:00", "dateReserved": "2009-03-31T00:00:00", "dateUpdated": "2024-08-07T05:04:49.236Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:screen:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "AFF73BAA-7734-46E6-9F9C-0A5AF3E5E365", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information."}, {"lang": "es", "value": "GNU Screen v4.0.3, crea el archivo temporal /tmp/screen-exchange con permisos de lectura, lo que permite a usuarios locales obtener informaci\u00f3n sensible."}], "id": "CVE-2009-1214", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-04-01T10:30:00.467", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"source": "cve@mitre.org", "url": "http://savannah.gnu.org/bugs/?25296"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/34521"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"source": "cve@mitre.org", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49886"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://savannah.gnu.org/bugs/?25296"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/34521"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49886"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Red Hat does not consider this to be a security issue. Affected file is supposed to be used to exchange information between local system users, therefore open permissions are intentional.", "lastModified": "2009-04-02T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}