Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Nov 2008 12:35:41 -0500 (EST)
From: "Steven M. Christey" <>
Subject: Re: CVE id request: htop

Sorry Jan and Nico, I didn't follow up with you on this.  There were some
questions about whether this deserved a CVE, since THOUSANDS of programs
dump output without considering whether they're writing to a terminal...
or what they're writing to a terminal.

For example, should the "cat" program become more terminal-aware and avoid
sending dangerous sequences?  Which of dozens of different terminal types
should it avoid sending these sequences to?  Should it get a new CVE every
time it forgets about some other terminal?

Not to mention "more" and "ls" and "grep" and many others.

We were forced to flag Apache a number of years ago because it didn't
filter certain dangerous characters from its logs.  I always felt a bit
funny about that one.

Hopefully you see why this is an edge case for us.

In this specific case, however, apparently top performs this behavior,
it's clearly intended to run in a terminal, *and* a vendor is stating it's
a security issue.  So, CVE-2008-5076 has been assigned.

- Steve

Name: CVE-2008-5076
Status: Candidate
Reference: MLIST:[oss-security] 20081102 CVE id request: htop
Reference: URL:
Reference: CONFIRM:
Reference: XF:htop-processname-weak-security(46321)
Reference: URL:

htop 0.7 writes process names to a terminal without sanitizing
non-printable characters, which might allow local users to hide
processes, modify arbitrary files, or have unspecified other impact
via a process name with "crazy control strings."

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.