oss-sec mailing list archives
Re: rxvt terminal (+bash) remoteish code execution 0day
From: def <def () huumeet info>
Date: Mon, 17 May 2021 17:33:48 +0300
Some minor clarifications. The bug is not technically a 0day for rxvt-unicode and has been known at least since 2017-05-01 when it was discussed publicly in oss-security: https://www.openwall.com/lists/oss-security/2017/05/01/20 The issue was quietly fixed in rxvt-unicode upstream in 2017. Most Linux distributions ship unpatched rxvt-unicode 9.22 (2016-01-23) because the first official fixed release version is rxvt-unicode 9.25 (2021-05-14). Yes, version numbers 9.23 & 9.24 were skipped in upstream. In any case, the vulnerability still counts as 0day against non-unicode rxvt 2.7.10, and forks such as mrxvt 0.5.4 and Enlightenment's eterm 0.9.7 terminal. Finally, the vulnerability can be exploited in any context in which the attacker can plant payload scripts in a subdirectory of CWD and trigger code execution by writing (unescaped) ANSI escape sequences to stdout or stderr. Suitable target programs besides `scp` include popular CLI tools such as `unrar` and `busybox tar` as demonstrated in the PoCs here: https://huumeet.info/~def/rxvt0day/ Note that GNU tar is not exploitable due to properly escaped filenames. - def
Current thread:
- rxvt terminal (+bash) remoteish code execution 0day def (May 17)
- Re: rxvt terminal (+bash) remoteish code execution 0day def (May 17)
- Re: rxvt terminal (+bash) remoteish code execution 0day Jakub Wilk (May 17)
- Re: rxvt terminal (+bash) remoteish code execution 0day Dan Yefihmov (May 17)
- Re: rxvt terminal (+bash) remoteish code execution 0day Jakub Wilk (May 17)
- Re: rxvt terminal (+bash) remoteish code execution 0day Priedhorsky, Reid (May 17)
- Re: rxvt terminal (+bash) remoteish code execution 0day def (May 17)