[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALx_OUCRbOcpFHyU=kju+WTZju-orChnU50wOP2Tw=8V3mpUtA@mail.gmail.com>
Date: Mon, 31 Aug 2015 22:41:53 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>, Hanno Böck <hanno@...eck.de>
Subject: Re: Terminal escape sequences - the new XSS for admins?
> This is why I am not happy about this thread's apparent decision to
> dismiss unsafe handling of likely terminal escapes (the known ranges) in
> untrusted input in individual programs as long as there are no known
> worse-than-DoS intentional features in modern terminal emulators.
> I would be happier to have this layer of security as well. Besides, DoS
> issues are a concern too, and are obviously available as intentional
> features in typical terminal emulators.
I definitely think it deserves a closer look. Here are three recent
finds that kcwu reported after apparently testing GNU screen with
afl-fuzz:
https://savannah.gnu.org/bugs/?45713
https://savannah.gnu.org/bugs/?45715
https://savannah.gnu.org/bugs/?45714
While I suspect that command injection bugs (the thing that started
the thread) are fairly rare, I fully expect that escape sequence
handling is under-audited and that there's plenty of mem corruption
bugs to be found.
(Cc:ing Hanno in case he wants to have a look.)
/mz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
