oss-security - Re: request CVE id: insecure handling of DISPLAY in rxvt

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 27 Mar 2008 03:03:22 +0100
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: request CVE id: insecure handling of DISPLAY in rxvt

On Tuesday 04 March 2008, Nico Golde wrote:
> It should be a good idea to check other terminal emulators
> as well.

The same issue also exists in:
aterm, tested 1.0.1
eterm, tested 0.9.4
mrxvt, tested 0.5.3
multi-aterm, tested 0.2.1
rxvt-unicode, tested 8.3 and 8.9
wterm, tested with 6.2.9

This is almost half of the terminal emulators I tried. There are 
probably tons of other X applications doing this, not all with the 
impact of a shell, but many allow starting other programs one way or 
another.

Reading the attack vector, I would consider it a vulnerability, but 
looking at the amount of programs that fall into this category, I'm 
worried how many programs do this and if the low impact is really worth 
fixing all of them.

Robert

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.