Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 253155 (CVE-2008-2383)

Summary: x11-terms/xterm <239 DECRQSS Escape Sequence Vulnerability (CVE-2008-2383)
Product: Gentoo Security Reporter: Bruno Buss <bruno.buss>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: major CC: dberkholz
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://secunia.com/Advisories/33318/
Whiteboard: A2? [glsa]
Package list:
Runtime testing required: ---

Description Bruno Buss 2008-12-30 16:41:06 UTC
Description:
"A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute arbitrary shell commands by e.g. tricking a user into displaying a malicious text file containing a specially crafted escape sequence via the "more" command in xterm."

There is a thread in debian ml (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030) that contains a fix:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=misc.c.patch;att=1;bug=510030
Comment 1 Bruno Buss 2009-01-08 12:56:44 UTC
Xterm 238 released:
http://invisible-island.net/xterm/xterm.log.html#xterm_238

We need a version bump here to fix the bug.
Comment 2 Donnie Berkholz (RETIRED) gentoo-dev 2009-01-19 04:51:00 UTC
239 is in the tree.
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2009-01-19 10:50:07 UTC
Arches, please test and mark stable:
=x11-terms/xterm-239
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 4 Jeroen Roovers (RETIRED) gentoo-dev 2009-01-19 12:32:42 UTC
Stable for HPPA.
Comment 5 Ferris McCormick (RETIRED) gentoo-dev 2009-01-19 13:22:43 UTC
Sparc stable.
Comment 6 Brent Baude (RETIRED) gentoo-dev 2009-01-19 16:11:07 UTC
ppc64 done
Comment 7 Raúl Porcel (RETIRED) gentoo-dev 2009-01-20 10:35:46 UTC
alpha/arm/ia64/s390/sh/x86 stable
Comment 8 Markus Meier gentoo-dev 2009-01-21 22:17:49 UTC
amd64 stable
Comment 9 Tobias Scherbaum (RETIRED) gentoo-dev 2009-01-24 18:36:55 UTC
ppc stable
Comment 10 Tobias Heinlein (RETIRED) gentoo-dev 2009-01-28 00:32:47 UTC
GLSA request filed.
Comment 11 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-02-12 22:02:11 UTC
GLSA 200902-04