Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 253155 (CVE-2008-2383) - x11-terms/xterm <239 DECRQSS Escape Sequence Vulnerability (CVE-2008-2383)
Summary: x11-terms/xterm <239 DECRQSS Escape Sequence Vulnerability (CVE-2008-2383)
Status: RESOLVED FIXED
Alias: CVE-2008-2383
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://secunia.com/Advisories/33318/
Whiteboard: A2? [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2008-12-30 16:41 UTC by Bruno Buss
Modified: 2009-02-12 22:02 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Bruno Buss 2008-12-30 16:41:06 UTC
Description:
"A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute arbitrary shell commands by e.g. tricking a user into displaying a malicious text file containing a specially crafted escape sequence via the "more" command in xterm."

There is a thread in debian ml (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030) that contains a fix:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=misc.c.patch;att=1;bug=510030
Comment 1 Bruno Buss 2009-01-08 12:56:44 UTC
Xterm 238 released:
http://invisible-island.net/xterm/xterm.log.html#xterm_238

We need a version bump here to fix the bug.
Comment 2 Donnie Berkholz (RETIRED) gentoo-dev 2009-01-19 04:51:00 UTC
239 is in the tree.
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2009-01-19 10:50:07 UTC
Arches, please test and mark stable:
=x11-terms/xterm-239
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 4 Jeroen Roovers gentoo-dev 2009-01-19 12:32:42 UTC
Stable for HPPA.
Comment 5 Ferris McCormick (RETIRED) gentoo-dev 2009-01-19 13:22:43 UTC
Sparc stable.
Comment 6 Brent Baude (RETIRED) gentoo-dev 2009-01-19 16:11:07 UTC
ppc64 done
Comment 7 Raúl Porcel (RETIRED) gentoo-dev 2009-01-20 10:35:46 UTC
alpha/arm/ia64/s390/sh/x86 stable
Comment 8 Markus Meier gentoo-dev 2009-01-21 22:17:49 UTC
amd64 stable
Comment 9 Tobias Scherbaum (RETIRED) gentoo-dev 2009-01-24 18:36:55 UTC
ppc stable
Comment 10 Tobias Heinlein (RETIRED) gentoo-dev 2009-01-28 00:32:47 UTC
GLSA request filed.
Comment 11 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-02-12 22:02:11 UTC
GLSA 200902-04