News for hackers. Stuff that matters.

A comment on Critical Security Issue Identified in iTerm2. Parent comment

Re:Critical Security Issue Identified in iTerm2 by swagonomixxx on Wednesday October 09, 2019 @01:33PM (#21205585)
For folks who don't use the Tmux integration, are they affected at all? I know that the post details that this occurs during usage of the Tmux integration, but is there a possibility that the same vulnerability is present in normal iTerm2 usage (i.e, no Tmux integration)?
[ Parent | on HN ]
Re:Critical Security Issue Identified in iTerm2 by gnachman on Wednesday October 09, 2019 @01:40PM (#21205682)
Yes, everyone should upgrade. An exploit would use the tmux integration control sequence without your consent.
[ Parent | on HN ]
Re:Critical Security Issue Identified in iTerm2 by ilikepi on Wednesday October 09, 2019 @02:48PM (#21206554)
Would you consider a feature request for a setting to disable the tmux integration feature? The exploit seems like good evidence for the need for this.

I finally got around to installing iTerm2 this year. It's great, thanks to you (and to all contributors) for all your hard work! I will say, though, that while features like shell integration sound powerful, I personally choose to keep them disabled in order to minimize attack surface. It would be nice to be able to disable tmux integration as well for the same reason, given I don't use tmux.

EDIT: clarification

[ Parent | on HN ]
Re:Critical Security Issue Identified in iTerm2 by gnachman on Wednesday October 09, 2019 @03:20PM (#21206878)
Yep, good idea. There is an advanced pref to disable potentially risky control sequences. I plan to invest in giving users the option to lock things down more so they can trade off convenience vs security as they see fit
[ Parent | on HN ]
Re:Critical Security Issue Identified in iTerm2 by capableweb on Wednesday October 09, 2019 @01:53PM (#21205852)
If you take a look at the demo shown in the blog post, it seems to show that you don't need to run tmux to be vulnerable. The demo video user is just in a normal tab.

https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/sec...

[ Parent | on HN ]