Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by JoshTriplett on Saturday March 20, 2021 @02:46PM
(#26525114)
It's not quite as bad as that; it sounds like you also have to select the text. (The corresponding vulnerability in "screen", by contrast, doesn't require interaction, which makes it even more serious.)
It's still extremely bad and should be patched immediately. But it doesn't appear to be a zero-interaction vulnerability, as far as I can tell from the description.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by kstrauser on Saturday March 20, 2021 @02:51PM
(#26525165)
I haven’t seen that yet. Do you have a link saying that you have to select text? That would help a lot in the mean time if true.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by JoshTriplett on Saturday March 20, 2021 @03:03PM
(#26525271)
See https://www.openwall.com/lists/oss-security/2021/02/09/7 :
> To reproduce in XTerm, decode the file then try to select the line.
For the original report on screen, see https://lists.gnu.org/archive/html/screen-devel/2021-02/msg0... (warning, contains the raw test case, may crash a text-based browser).
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by craig131 on Saturday March 20, 2021 @03:17PM
(#26525368)
https://invisible-island.net/xterm/xterm.log.html#xterm_366
Specifically, the overflow is in the upper limit of the text selection buffer when characters are combined in UTF-8.
- Someone dislikes JavaScript and uses Lynx in xterm for their browsing. Make a web page that such people are likely to want to view.
- Someone doesn’t like HTML email or tracking pixels, so they use Mutt in xterm. Put the crafted bytes in the subject of an email to them.
- Put it in the MOTD of an SSH server. For that matter, in the version string of your server so that someone running “ssh -v attacker.example.com” sees it.
This is so bad. Please go patch your systems immediately.