Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Aug 2015 16:13:48 -0400
From: Daniel Kahn Gillmor <dkg@...thhorseman.net>
To: Kurt Seifried <kseifried@...hat.com>, oss-security <oss-security@...ts.openwall.com>
Subject: Re: Terminal escape sequences - the new XSS for admins?

On Tue 2015-08-11 12:23:59 -0400, Kurt Seifried wrote:
> So we've had a bunch of this stuff over the years:
>
> http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=terminal+escape
>
> And now more recently:
>
> http://turbochaos.blogspot.ca/2014/08/journalctl-terminal-escape-injection.html
> https://bugzilla.redhat.com/show_bug.cgi?id=1084577
>
> And we have at least one more coming down the pipeline that's pretty
> widespread.
>
> Also I'm thinking of all those docker apps that log to STDOUT.
>
> So the basic TL;DR: please don't use really ancient terminal programs that
> are vulnerable to this stuff. It appears in testing that most (all?) of the
> Red Hat stuff is ok, but I can't speak for other vendors.

Do we have a catalog of terminal programs that are vulnerable, or of
particularly dangerous escape sequences to test with each terminal
emulator?  I'd be happy to try to organize a torches-and-pitchforks run
through the debian archive if i know what to look for.

https://security.stackexchange.com/questions/56307/can-cat-ing-a-file-be-a-potential-security-risk

has some good links and discussion from just last year but nothing
systematized that i can see.

   --dkg

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.