Vulnerability Note VU#230561

gnome-terminal allows arbitrary command execution when viewing files containing crafted escape sequences

Overview

gnome-terminal may allow a remote attacker to execute arbitrary commands via crafted escape sequences.

I. Description

gnome-terminal affords users the ability to utilize an escape sequence to "export" the title of the current window title directly to the shell command line. By viewing a maliciously crafted file in gnome-terminal, a victim may unknowingly execute shell commands (provided by the attacker).

This vulnerability was discovered by H D Moore of Digital Defense. H D has provided a paper on this topic (TERMINAL EMULATOR SECURITY ISSUES), and Red Hat has published RHSA-2003:053-10. Both of these documents provide more information about this vulnerability.

II. Impact

A remote attacker may be able to execute arbitrary commands on a vulnerable host.

III. Solution

Apply a patch.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Red Hat Inc.	Vulnerable	27-Feb-2003

References

http://www.digitaldefense.net/labs/papers/Termulation.txt
https://rhn.redhat.com/errata/RHSA-2003-053.html

Credit

This vulnerability was discovered by H D Moore of Digital Defense. The CERT/CC thanks both H D Moore and Red Hat for providing information upon which this document is based.

This document was written by Ian A Finlay.

Other Information

Date Public:	2003-02-24
Date First Published:	2003-02-27
Date Last Updated:	2003-02-27
CERT Advisory:
CVE-ID(s):	CAN-2003-0070
NVD-ID(s):	CAN-2003-0070
US-CERT Technical Alerts:
Severity Metric:	4.86
Document Revision:	5

If you have feedback, comments, or additional information about this vulnerability, please send us email.