[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <3251855.920OV3rWUH@x2>
Date: Tue, 11 Aug 2015 17:59:17 -0400
From: Steve Grubb <sgrubb@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Andy Lutomirski <luto@...capital.net>,
Daniel Kahn Gillmor <dkg@...thhorseman.net>,
Kurt Seifried <kseifried@...hat.com>
Subject: Re: Re: Terminal escape sequences - the new XSS for admins?
On Tuesday, August 11, 2015 02:40:12 PM Andy Lutomirski wrote:
> > At this point, I was convinced that most major emulators are safe. That
> > said...there are all the ones I didn't check including older ones. The
> > older ones are likely to be the ones I'd be most concerned about.
>
> Are all the supposedly invulnerable terminals actually safe?
> Gnome-terminal reports:
>
> 0000000: 1b5d 6c54 6572 6d69 6e61 6c1b 5c .]lTerminal.\
>
> That's not as bad as echoing 'ls -al' back to the terminal input, but
> why is it considered acceptable for terminals to input anything
> whatsoever in response to the in-band data they receive?
The whole idea is to write something that you can bounce back to the prompt.
lTerminal is pretty limiting. An attacker would have to also place the file
lTerminal in the search path before using this trick. But if they can do pre-
place a file in the search path, they can also take advantage of typing
mistakes like placing a file vo and then waiting for the admin to make a
mistake typing vi.
What you really want to do in an attack is to try placing a call back shell
command on the prompt or download/upload files.
Most terminal emulators, konsole for example, reply with nothing. Its the vte
based ones that reply like this.
-Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
