bugtraq - Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <412BC304.4000101@gmx.net>
Date: Wed, 25 Aug 2004 01:36:52 +0300
From: Serkan Akpolat <sakpolat@....net>
To: Jan Minar <jjminar@...tmail.fm>
Cc: bugtraq@...urityfocus.com
Subject: Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability


Jan Minar wrote:
> On Mon, Aug 23, 2004 at 09:32:15PM +0300, Serkan Akpolat wrote:
> 
>>If Hafiye has been started with -n packet count option ,
>>the vulnerability could allow remote code execution.
>>For remote code execution  the victim must press Enter after program exit.
> 
> 
>>                       "\x1b""]2;Insecure?""\x07\x0a",
>>                       "\x07\x07\x07\x07\x07\x07",
>>                       "\x1b""]2;;echo Owned > /root/Owned.txt"
>>                       "\x07\x1b""[21t""\x1b""]2;xterm""\x07"
>>                       "Abnormal Termination""\x1b"
>>                       "[8m;""\x0a"};
> 
> 
> That is, with broken terminals/emulators, such as is rxvt in Debian
> Woody (at the time of my writing this).  These devices/programs should
> have been fixed long time ago in the first place.  (Not that (albeit
> crippled) echo-back escape sequences were a good idea anyway.)
> 
> Jan.
> 
> 

True. My test environment was default slack 9.1 and fbsd 4.7 with xterm. 
Echo-back esc-sequence seems to be fixed in the current xterm.