oss-sec mailing list archives
Re: terminal emulators' processing of escape sequences
From: Robert Święcki <robert () swiecki net>
Date: Wed, 17 May 2017 12:51:57 +0200
Hi,
On Tue, May 02, 2017 at 12:05:27AM +0200, Robert ??wi??cki wrote:A harmless example from rxvt - pushing back the new-line character: $ echo -ne "\eGQ;" ;$ 0 bash: 0: command not foundDoes this also affect rxvt-unicode?It does, actually. I've CCd rxvt-unicode upstream on this in order to hear their assessment.There can't be an assessment without knowledge of what to assess - there is little to no information in your mail. I can only guess that somebody for the hundredth time found out that terminals are more than dumb display devices and got excited that, somehow, this might be a security issue. Without knowing details, I can't say for sure, but most likely, this is a security issue the same way blindly feeding unknown commands to your shell is,
Given that arbitrary data can be pushed to terminal emulators via seemingly harmless commands (like ping, whois) that people rather trust to be robust enough to intetract with arbitrary whois or DNS servers, this might be some problem. Please consider the following example: $ tail -n1 /etc/hosts | xxd 00000000: 3132 372e 302e 302e 3309 1b47 513b 205a 127.0.0.3..GQ; Z 00000010: 5a5a 0a ZZ. $ ping ZZZ PING ; (127.0.0.3) 56(84) bytes of data. ^[G0 64 bytes from ; (127.0.0.3): icmp_seq=1 ttl=64 time=0.039 ms ^[G0 64 bytes from ; (127.0.0.3): icmp_seq=2 ttl=64 time=0.032 ms ^[G0 ^C --- ; ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1014ms rtt min/avg/max/mdev = 0.032/0.035/0.039/0.006 ms ^[G0 $ 0 bash: 0: command not found I'm not sure if this works with real reverse DNS look-ups, but with /etc/hosts it seems so.
i.e., it's a problem somewhere else - the protocol between terminals and programs is not a (strong) security barrier. (your echo command is bash-specific, btw.)
-- Robert Święcki
Current thread:
- Re: terminal emulators' processing of escape sequences, (continued)
- Re: terminal emulators' processing of escape sequences Yves-Alexis Perez (May 01)
- Re: terminal emulators' processing of escape sequences Yves-Alexis Perez (May 01)
- Re: terminal emulators' processing of escape sequences Michal Zalewski (May 01)
- Re: terminal emulators' processing of escape sequences Robert Święcki (May 01)
- Re: terminal emulators' processing of escape sequences Robert Święcki (May 03)
- Re: terminal emulators' processing of escape sequences Solar Designer (May 16)
- Re: terminal emulators' processing of escape sequences Robert Święcki (May 16)
- Re: terminal emulators' processing of escape sequences Yui Hirasawa (May 19)
- Re: terminal emulators' processing of escape sequences Jason A. Donenfeld (May 17)
- Re: terminal emulators' processing of escape sequences Marc Lehmann (May 16)
- Re: terminal emulators' processing of escape sequences Robert Święcki (May 17)
- AW: terminal emulators' processing of escape sequences Fiedler Roman (May 17)
- Re: terminal emulators' processing of escape sequences Daniel Kahn Gillmor (May 17)
- Re: terminal emulators' processing of escape sequences Robert Święcki (May 17)
- Re: terminal emulators' processing of escape sequences Robert Święcki (May 17)
- Re: terminal emulators' processing of escape sequences Daniel Kahn Gillmor (May 18)
- Re: terminal emulators' processing of escape sequences Tavis Ormandy (May 19)
- Re: terminal emulators' processing of escape sequences Robert Święcki (May 01)
- Re: terminal emulators' processing of escape sequences Yves-Alexis Perez (May 01)
- Re: terminal emulators' processing of escape sequences Solar Designer (May 17)
- Re: terminal emulators' processing of escape sequences Marc Lehmann (May 17)
- rxvt-unicode "insecure" setting [Was: terminal emulators' processing of escape sequences] Ian Zimmerman (May 17)
- Re: terminal emulators' processing of escape sequences Dominique Martinet (May 17)