Bug 478888 - (CVE-2008-2383) CVE-2008-2383 xterm: arbitrary command injection
CVE-2008-2383 xterm: arbitrary command injection
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 478895 478896 478897 478898 478899 478954
  Show dependency treegraph
Reported: 2009-01-05 16:08 EST by Mark J. Cox
Modified: 2009-01-08 07:44 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-01-08 07:44:23 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch extracted from upstream (1.62 KB, patch)
2009-01-05 21:14 EST, Josh Bressers
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:0018 normal SHIPPED_LIVE Important: xterm security update 2009-01-07 06:09:39 EST
Red Hat Product Errata RHSA-2009:0019 normal SHIPPED_LIVE Important: hanterm-xf security update 2009-01-07 08:42:50 EST

  None (edit)
Description Mark J. Cox 2009-01-05 16:08:18 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2383 to the following vulnerability:

CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.

This issue affects xterm as shipped with Red Hat Enterprise Linux 3, 4, and 5.
Comment 4 Josh Bressers 2009-01-05 21:14:48 EST
Created attachment 328245 [details]
Patch extracted from upstream
Comment 7 Mark J. Cox 2009-01-06 05:23:08 EST
The version of xterm as shipped in Red Hat Enterprise Linux 2.1 is not affected by this issue.

The reason is that in the older xterm version control characters such as \n characters were not allowed in a device control string.  When building up the string to pass to do_dcs, xterm uses the sos_table (VTPrsTbl.c) to parse each character.  Each valid character is set to CASE_IGNORE.  So a trace of a vulnerable (rhel-3) xterm shows:

parse 001B -> 5 ansi_table
parse 0050 -> 87 esc_table
CASE_DCS: Device Control String
parse 0024 -> 1 sos_table
CASE_IGNORE - Ignore character 24
parse 0071 -> 1 sos_table
CASE_IGNORE - Ignore character 71
parse 000D -> 1 sos_table
CASE_IGNORE - Ignore character 0D
parse 000A -> 1 sos_table
parse 001B -> 5 sos_table
parse 005C -> 90 esc_table
CASE_ST: End of String (18 bytes)

But in the xterm in RHEL-2.1 control characters are not ignored:

parse 001B -> 7 ansi_table
parse 0050 -> 89 esc_table
parse 0024 -> 3 sos_table
parse 0071 -> 3 sos_table
parse 000D -> 6 sos_table
parse 000A -> 8 ansi_table

That renders this flaw as unexploitable on RHEL-2.1 xterm.
Comment 9 Mark J. Cox 2009-01-06 10:03:15 EST
Updated xterm packages for Red Hat Enterprise Linux 3, 4, 5 have been built and are currently completing testing.  As soon as they have passed they will be pushed to Red Hat Network.

Note You need to log in before you can comment on or make changes to this bug.