oss-sec mailing list archives
Re: Terminal escape sequences - the new XSS for admins?
From: Michal Zalewski <lcamtuf () coredump cx>
Date: Mon, 31 Aug 2015 22:41:53 -0700
This is why I am not happy about this thread's apparent decision to dismiss unsafe handling of likely terminal escapes (the known ranges) in untrusted input in individual programs as long as there are no known worse-than-DoS intentional features in modern terminal emulators. I would be happier to have this layer of security as well. Besides, DoS issues are a concern too, and are obviously available as intentional features in typical terminal emulators.
I definitely think it deserves a closer look. Here are three recent finds that kcwu reported after apparently testing GNU screen with afl-fuzz: https://savannah.gnu.org/bugs/?45713 https://savannah.gnu.org/bugs/?45715 https://savannah.gnu.org/bugs/?45714 While I suspect that command injection bugs (the thing that started the thread) are fairly rare, I fully expect that escape sequence handling is under-audited and that there's plenty of mem corruption bugs to be found. (Cc:ing Hanno in case he wants to have a look.) /mz
Current thread:
- Re: Terminal escape sequences - the new XSS for admins?, (continued)
- Re: Terminal escape sequences - the new XSS for admins? Daniel Kahn Gillmor (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Steve Grubb (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Stephane Chazelas (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Florian Weimer (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Andy Lutomirski (Aug 11)
- Re: Re: Terminal escape sequences - the new XSS for admins? Steve Grubb (Aug 11)
- Re: Re: Terminal escape sequences - the new XSS for admins? Robert Święcki (Aug 12)
- Re: Re: Terminal escape sequences - the new XSS for admins? Dave Horsfall (Aug 12)
- Re: Terminal escape sequences - the new XSS for admins? Steve Grubb (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Daniel Kahn Gillmor (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Solar Designer (Aug 17)
- Re: Terminal escape sequences - the new XSS for admins? Michal Zalewski (Aug 31)
- Re: Terminal escape sequences - the new XSS for admins? Michal Zalewski (Aug 31)