{"id":105528,"date":"2022-11-12T15:36:44","date_gmt":"2022-11-12T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok"},"modified":"2022-11-12T15:36:44","modified_gmt":"2022-11-12T13:36:44","slug":"uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","title":{"rendered":"xtermis avastatud haavatavus, mis v\u00f5ib p\u00f5hjustada koodi k\u00e4ivitamist teatud ridade t\u00f6\u00f6tlemisel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Xterm terminal emulator has a vulnerability (CVE-2022-45063) that allows the execution of shell commands when processing certain escape sequences in the terminal. The simplest attack scenario involves displaying the contents of a specially crafted file on the screen, for instance, using the cat utility, or pasting a line from the clipboard. printf «\e]50;i\$(touch \/tmp\/hack-like-its-1999)\a\e]50;?\a» > cve-2022-45063 cat cve-2022-45063 <\/p>\n
The problem is caused by an error in processing the escape sequence with code 50, which is used for setting or getting font parameters. If the requested font does not exist, the operation returns the specified font name. Control characters cannot be directly inserted into the name, but the returned string can be terminated with the sequence «^G», which in zsh, when the vi-style line editing mode is active, leads to the execution of the completion operation, which can be used to run commands without explicitly pressing the Enter key. <\/p>\n
To successfully exploit the vulnerability, the user must use the Zsh shell with the command line editor switched to «vi» command mode (vi-cmd-mode), which is typically not enabled by default in distributions. The problem also does not occur when setting allowWindowOps=false or allowFontOps=false in xterm. For example, the allowFontOps=false setting is applied in OpenBSD, Debian, and RHEL, but not by default in Arch Linux. <\/p>\n
According to the changelog and the statement from the researcher who discovered the issue, the vulnerability was fixed in release xterm 375, but other reports indicate that the vulnerability continues to manifest in xterm 375 from Arch Linux. You can track the release of fixes by distributions on these pages: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD. \n Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"