Junglewise Threat Intelligence

CVE-2015-8971: Enlightenment Terminology command injection via escape sequences

CVE-2015-8971 · Severity: high · CVSS 7.8 · Published 2017-01-23

Technologies: Debian Linux. Vendors: Debian.

Executive brief

Terminology, a terminal emulator for Linux systems, contains a vulnerability that allows an attacker to execute unauthorized commands. By tricking the system into displaying specially crafted text (such as in a log file), an attacker can force the terminal to inject commands directly into the user's command prompt. This could lead to a full takeover of the user's account and access to their private data.

Technical details

Terminology 0.7.0 is vulnerable to a command injection flaw via improper neutralization of terminal escape sequences. An attacker can provide a malicious string (e.g., via a log file or cat-ing a file) containing escape sequences that first modify the window title and then use a reporting sequence to push that title back into the terminal's input buffer. This results in arbitrary terminal input being executed by the user's shell. The vulnerability is rooted in the handling of escape sequences in 'src/bin/termptyesc.c' and has been patched in subsequent versions.

Affected products

  • Enlightenment Project Terminology 0.7.0

Timeline

  • 2016-11-04: disclosed: Vulnerability details shared on oss-security mailing list
  • 2016-11-13: patched: Debian released security update DSA-3712-1
  • 2017-01-23: advisory: NVD published the CVE record

References

Related threats