Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Aug 2015 16:13:48 -0400
From: Daniel Kahn Gillmor <>
To: Kurt Seifried <>, oss-security <>
Subject: Re: Terminal escape sequences - the new XSS for admins?

On Tue 2015-08-11 12:23:59 -0400, Kurt Seifried wrote:
> So we've had a bunch of this stuff over the years:
> And now more recently:
> And we have at least one more coming down the pipeline that's pretty
> widespread.
> Also I'm thinking of all those docker apps that log to STDOUT.
> So the basic TL;DR: please don't use really ancient terminal programs that
> are vulnerable to this stuff. It appears in testing that most (all?) of the
> Red Hat stuff is ok, but I can't speak for other vendors.

Do we have a catalog of terminal programs that are vulnerable, or of
particularly dangerous escape sequences to test with each terminal
emulator?  I'd be happy to try to organize a torches-and-pitchforks run
through the debian archive if i know what to look for.

has some good links and discussion from just last year but nothing
systematized that i can see.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.