{"id":105528,"date":"2022-11-12T15:36:44","date_gmt":"2022-11-12T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok"},"modified":"2022-11-12T15:36:44","modified_gmt":"2022-11-12T13:36:44","slug":"uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","title":{"rendered":"Vulnerability in xterm leading to code execution through specific strings processing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the xterm terminal emulator (CVE-2022-45063) that allows the execution of shell commands through the processing of certain escape sequences in the terminal. To exploit this vulnerability, an attacker can simply display the contents of a specially crafted file on the screen, for example using the cat utility, or paste a string from the clipboard. printf \"\\e]50;i\\$(touch \/tmp\/hack-like-its-1999)\\a\\e]50;?\\a\" > cve-2022-45063 cat cve-2022-45063 <\/p>\n
The issue is caused by an error in processing the escape sequence with code 50, which is used to set or retrieve font parameters. If the requested font does not exist, the operation returns the name of the font as specified in the request. Control characters cannot be directly inserted into the name, but the returned string can be terminated with the sequence \"^G\", which in zsh, when in vi-style line editing mode, triggers a list expansion operation, allowing commands to be executed without explicitly pressing the Enter key. <\/p>\n
For successful exploitation of the vulnerability, the user must utilize the Zsh shell with the command line editor in \"vi\" mode (vi-cmd-mode), which is not typically enabled by default in distributions. The issue also does not manifest when the xterm settings allowWindowOps=false or allowFontOps=false are set. For instance, the allowFontOps=false setting is applied in OpenBSD, Debian, and RHEL, but is not enabled by default in Arch Linux. <\/p>\n
According to the changelog and the statement from the researcher who identified the issue, the vulnerability has been fixed in xterm release 375, but other sources indicate that the vulnerability continues to be present in xterm 375 from Arch Linux. You can track the distribution of patches on the following pages: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"