CAN-2003-0021 Screen Dump: Eterm [ Screen Dumping ] Eterm and rxvt both implement what they call the "screen dump" feature. This escape sequence will cause an arbitrary file to be opened and filled with the current contents of the terminal window. These are the only two tested emulators[1] that still had the ability to write to files enabled by default. Although rxvt will ignore dump requests for existing files, Eterm[2] will happily delete the file and then create it again. [2] Eterm actually disabled this in 0.9.2 (October 31, 2002), however many recent Linux distributions still shipped with 0.9.1. So i would suggest unmasking the 0.9.2 ebuilds and masking (or removing) the 0.9.1-r5 ebuild Reproducible: Always Steps to Reproduce:
[RHSA-2003:054-00] Updated rxvt packages fix various vulnerabilites From: bugzilla@redhat.com To: redhat-watch-list@redhat.com, redhat-announce-list@redhat.com Date: Yesterday 14.44.00 --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated rxvt packages fix various vulnerabilites Advisory ID: RHSA-2003:054-00 Issue date: 2003-03-17 Updated on: 2003-03-17 Product: Red Hat Linux Keywords: trojan escape reporting Cross references: Obsoletes: CVE Names: CAN-2003-0022 CAN-2003-0023 CAN-2003-0066 --------------------------------------------------------------------- 1. Topic: Updated rxvt packages are available which fix a number of vulnerabilities in the handling of escape sequences. 2. Relevant releases/architectures: Red Hat Linux 6.2 - i386 Red Hat Linux 7.0 - i386 Red Hat Linux 7.1 - i386 Red Hat Linux 7.2 - i386, ia64 Red Hat Linux 7.3 - i386 3. Problem description: Rxvt is a color VT102 terminal emulator for the X Window System. A number of issues have been found in the escape sequence handling of Rxvt. These could be potentially exploited if an attacker can cause carefully crafted escape sequences to be displayed on a rxvt terminal being used by their victim. One of the features which most terminal emulators support is the ability for the shell to set the title of the window using an escape sequence. Certain xterm variants, including rxvt, also provide an escape sequence for reporting the current window title. This essentially takes the current title and places it directly on the command line. Since it is not possible to embed a carriage return into the window title itself, the attacker would have to convince the victim to hit enter for it to process the title as a command, although the attacker can perform a number of actions to increase the likelyhood of this happening. The "screen dump" feature in rxvt 2.7.8 allows attackers to overwrite arbitrary files via a certain character escape sequence when it is echoed to a user's terminal, e.g. when the user views a file containing the malicious sequence. The menuBar feature in rxvt 2.7.8 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the menu. Users of Rxvt are advised to upgrade to these errata packages which contain a patch to disable the title reporting functionality and patches to correct the other issues. Red Hat would like to thank H D Moore for bringing these issues to our attention. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. RPMs required: Red Hat Linux 6.2: SRPMS: ftp://updates.redhat.com/6.2/en/os/SRPMS/rxvt-2.7.8-3.6.2.1.src.rpm i386: ftp://updates.redhat.com/6.2/en/os/i386/rxvt-2.7.8-3.6.2.1.i386.rpm Red Hat Linux 7.0: SRPMS: ftp://updates.redhat.com/7.0/en/os/SRPMS/rxvt-2.7.8-3.7.0.1.src.rpm i386: ftp://updates.redhat.com/7.0/en/os/i386/rxvt-2.7.8-3.7.0.1.i386.rpm Red Hat Linux 7.1: SRPMS: ftp://updates.redhat.com/7.1/en/os/SRPMS/rxvt-2.7.8-3.7.1.1.src.rpm i386: ftp://updates.redhat.com/7.1/en/os/i386/rxvt-2.7.8-3.7.1.1.i386.rpm Red Hat Linux 7.2: SRPMS: ftp://updates.redhat.com/7.2/en/os/SRPMS/rxvt-2.7.8-4.src.rpm i386: ftp://updates.redhat.com/7.2/en/os/i386/rxvt-2.7.8-4.i386.rpm ia64: ftp://updates.redhat.com/7.2/en/os/ia64/rxvt-2.7.8-4.ia64.rpm Red Hat Linux 7.3: SRPMS: ftp://updates.redhat.com/7.3/en/os/SRPMS/rxvt-2.7.8-4.src.rpm i386: ftp://updates.redhat.com/7.3/en/os/i386/rxvt-2.7.8-4.i386.rpm 6. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 356e4148537e1e522cdcbedfb735ef80 6.2/en/os/SRPMS/rxvt-2.7.8-3.6.2.1.src.rpm 8ce644f8e66b473ef91ea5baa70066ea 6.2/en/os/i386/rxvt-2.7.8-3.6.2.1.i386.rpm 08bc3ef32e1bc77836dc266af8ef2fa1 7.0/en/os/SRPMS/rxvt-2.7.8-3.7.0.1.src.rpm b93bc19a8403c72943b33779b44b28fe 7.0/en/os/i386/rxvt-2.7.8-3.7.0.1.i386.rpm cf99378c595e06eed1ff0c2a493d0472 7.1/en/os/SRPMS/rxvt-2.7.8-3.7.1.1.src.rpm f973a30d1f45f561a1e15d4c58615526 7.1/en/os/i386/rxvt-2.7.8-3.7.1.1.i386.rpm f5b4712eeb3c941b9b5f2cf3ab6d6dc4 7.2/en/os/SRPMS/rxvt-2.7.8-4.src.rpm 94a3cbbf0dbd8739e9b1b2cc716a326e 7.2/en/os/i386/rxvt-2.7.8-4.i386.rpm 781b84624dda1114d74d09814438c54a 7.2/en/os/ia64/rxvt-2.7.8-4.ia64.rpm f5b4712eeb3c941b9b5f2cf3ab6d6dc4 7.3/en/os/SRPMS/rxvt-2.7.8-4.src.rpm 94a3cbbf0dbd8739e9b1b2cc716a326e 7.3/en/os/i386/rxvt-2.7.8-4.i386.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at http://www.redhat.com/about/contact/pgpkey.html You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum <filename> 7. References: http://marc.theaimsgroup.com/?l=bugtraq&m=104612710031920 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0022 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0023 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0066 8. Contact: The Red Hat security contact is <security@redhat.com>. More contact details at http://www.redhat.com/solutions/security/news/contact.html Copyright 2003 Red Hat, Inc.
eterm 0.9.2 has been unmasked for some time ...
