PT-2007-1106 · Xfce · Xfce Terminal

Lasse Kärkkäinen · Publicado 2007-07-15 · Atualizado 2017-07-29 · CVE-2007-3770

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Xfce Terminal version 0.2.6 terminal versions prior to 0.2.6 p25931

Description: The issue allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a crafted link. This can be demonstrated using the "Open Link" functionality. Exploitation of this issue may lead to a violation of confidentiality and integrity of protected information and can be carried out remotely.

Recommendations: For Xfce Terminal version 0.2.6, consider disabling the terminal helper execute function as a temporary workaround until a patch is available. For terminal versions prior to 0.2.6 p25931, restrict access to the "Open Link" functionality to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-09588

CVE-2007-3770

DSA-1393-1

Produtos afetados

Xfce Terminal

Referências · 16

• http://secunia.com/advisories/26037 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200708-07.xml · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09588 · Nota de Segurança
• http://secunia.com/advisories/26418 · Nota
• http://bugs.gentoo.org/show_bug.cgi?id=184886 · Nota
• http://secunia.com/advisories/27374 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3770 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35379 · Nota
• http://ubuntu.com/usn/usn-497-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2007-3770 · Aviso do Fabricante
• http://debian.org/security/2007/dsa-1393 · Aviso do Fabricante
• http://secunia.com/advisories/26392 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-3770 · Aviso do Fabricante
• http://osvdb.org/38082 · Nota
• http://securityfocus.com/bid/24889 · Nota