CVE-2015-6806

What it actually does

Unbounded recursion in MScrollV when processing an escape sequence with a large repeat count leads to stack exhaustion and process crash.

Why it matters to the business

Attackers can remotely crash terminal multiplexers, interrupting user sessions and requiring manual restarts with potential loss of unsaved work.

How an attack unfolds

An attacker sends a crafted ANSI escape sequence containing a large repeat count directly to a vulnerable screen instance; the MScrollV handler recurses without limit until the stack is exhausted.

How to fix it

Upgrade GNU screen to a version newer than 4.3.1 that contains the recursion limit fix; if no newer package is available, replace the utility or restrict exposure of terminal sessions to untrusted input.

How to confirm the fix worked

Confirm the installed screen binary version is newer than 4.3.1 and test that the MScrollV recursion path rejects oversized repeat counts without crashing.

Typical attack path

1. Identify a target running an exposed or locally reachable GNU screen session
2. Craft an escape sequence with an oversized repeat count value
3. Deliver the sequence via terminal input, paste, or network protocol that reaches the ansi parser
4. Trigger stack consumption resulting in immediate denial of service

How to detect it

Review terminal session logs and process crash reports for sudden stack overflows or segmentation faults immediately after receipt of ANSI escape sequences; correlate with user activity that includes pasted or received terminal control data.

What your security team should do

• Immediately upgrade all GNU screen installations to a fixed release
• Disable or sandbox screen where untrusted input can reach the terminal emulator
• Monitor for any remaining instances older than 4.3.1 and prioritize replacement