Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 31 Aug 2015 22:41:53 -0700
From: Michal Zalewski <>
To: oss-security <>, Hanno Böck <>
Subject: Re: Terminal escape sequences - the new XSS for admins?

> This is why I am not happy about this thread's apparent decision to
> dismiss unsafe handling of likely terminal escapes (the known ranges) in
> untrusted input in individual programs as long as there are no known
> worse-than-DoS intentional features in modern terminal emulators.
> I would be happier to have this layer of security as well.  Besides, DoS
> issues are a concern too, and are obviously available as intentional
> features in typical terminal emulators.

I definitely think it deserves a closer look. Here are three recent
finds that kcwu reported after apparently testing GNU screen with

While I suspect that command injection bugs (the thing that started
the thread) are fairly rare, I fully expect that escape sequence
handling is under-audited and that there's plenty of mem corruption
bugs to be found.

(Cc:ing Hanno in case he wants to have a look.)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.