full-disclosure - Re: Terminal Emulator Security Issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: steve.wray at paradise.net.nz (Steve Wray)
Subject: Re: Terminal Emulator Security Issues

> On Monday, 24 February 2003, at 15:02:52 (-0600),
> H D Moore wrote:
> 
> > Eterm and rxvt both implement what they call the "screen dump"
[snip]
> > followed by the screen dump command.
> > 
> > $ echo -e "\ec+ +\n\e]<Code>;/home/user/.rhosts\a"
> 
> As you noted, this is no longer possible with the current release of
> Eterm, which has been out for some time now.  I didn't think it was
> exploitable until, through a discussion related to this Debian bug:
> 
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=141374&archive=yes
 
Isn't this one of the generic problems with running the stable
debian distro? It tends to get left behind. Sort of like end-of-life
only undeclared...