Re:CVE-2017-16544: A Busybox autocompletion vulnerability
by helper on Monday November 20, 2017 @12:31PM
(#15741562)
How do you get privilege escalation from shell escape sequences?
[ Parent
| on HN ]
Re:CVE-2017-16544: A Busybox autocompletion vulnerability
by vetrom on Monday November 20, 2017 @04:57PM
(#15743677)
It would be a stretch, but lets say you're driving some poorly thought out automation over a pty that has some sort of terminal emulator attached that has any sort of output-changeable answerback-like sequence.
The pty part is important because some software will assume you're running interactive if it sees that its STDIN/OUT is a pty, and change its functionality accordingly.