debianxterm-weakness.txt
Posted on 07 January 2009
Package: xterm Version: 222-1etch2 Severity: grave Tags: security patch Justification: user security hole DECRQSS Device Control Request Status String "DCS $ q" simply echoes (responds with) invalid commands. For example, perl -e 'print "eP$q bad-command e\"' would run bad-command. Exploitability is the same as for the "window title reporting" issue in DSA-380: include the DCS string in an email message to the victim, or arrange to have it in syslog to be viewed by root. Original: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 Test: perl -e 'print "eP$q whoami e\"' > bla.log cat bla.log If whoami gets executed you should update. So stop using cat or more ;) Rembrandt
