Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 27 Mar 2008 03:03:22 +0100
From: Robert Buchholz <>
Subject: Re: request CVE id: insecure handling of DISPLAY in rxvt

On Tuesday 04 March 2008, Nico Golde wrote:
> It should be a good idea to check other terminal emulators
> as well.

The same issue also exists in:
aterm, tested 1.0.1
eterm, tested 0.9.4
mrxvt, tested 0.5.3
multi-aterm, tested 0.2.1
rxvt-unicode, tested 8.3 and 8.9
wterm, tested with 6.2.9

This is almost half of the terminal emulators I tried. There are 
probably tons of other X applications doing this, not all with the 
impact of a shell, but many allow starting other programs one way or 

Reading the attack vector, I would consider it a vulnerability, but 
looking at the amount of programs that fall into this category, I'm 
worried how many programs do this and if the low impact is really worth 
fixing all of them.


Download attachment "signature.asc " of type "application/pgp-signature" (190 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.