Date: Tue, 11 Aug 2015 16:13:48 -0400 From: Daniel Kahn Gillmor <dkg@...thhorseman.net> To: Kurt Seifried <kseifried@...hat.com>, oss-security <oss-security@...ts.openwall.com> Subject: Re: Terminal escape sequences - the new XSS for admins? On Tue 2015-08-11 12:23:59 -0400, Kurt Seifried wrote: > So we've had a bunch of this stuff over the years: > > http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=terminal+escape > > And now more recently: > > http://turbochaos.blogspot.ca/2014/08/journalctl-terminal-escape-injection.html > https://bugzilla.redhat.com/show_bug.cgi?id=1084577 > > And we have at least one more coming down the pipeline that's pretty > widespread. > > Also I'm thinking of all those docker apps that log to STDOUT. > > So the basic TL;DR: please don't use really ancient terminal programs that > are vulnerable to this stuff. It appears in testing that most (all?) of the > Red Hat stuff is ok, but I can't speak for other vendors. Do we have a catalog of terminal programs that are vulnerable, or of particularly dangerous escape sequences to test with each terminal emulator? I'd be happy to try to organize a torches-and-pitchforks run through the debian archive if i know what to look for. https://security.stackexchange.com/questions/56307/can-cat-ing-a-file-be-a-potential-security-risk has some good links and discussion from just last year but nothing systematized that i can see. --dkg
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.