PT-2003-1061 · Gnome · Vte-Devel+1

Daniel Ahlberg · Published 2003-02-24 · Updated 2016-10-18 · CVE-2003-0070

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vte versions 0.8.19 vte-devel versions 0.8.19

Description The issue allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal. This could enable the attacker to execute arbitrary commands, for example, when the user views a file containing the malicious sequence. Exploitation of this issue can be done remotely and may lead to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For vte version 0.8.19, consider disabling the use of character escape sequences in the terminal emulator until a patch is available. For vte-devel version 0.8.19, restrict the insertion of modified window titles back into the command line to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-07916

BDU:2015-07917

CVE-2003-0070

Affected Products

Vte

Vte-Devel

References · 12

• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0070 · Vendor Advisory
• http://iss.net/security_center/static/11414.php · Vendor Advisory
• http://seclists.org/lists/bugtraq/2003/Mar/0010.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07917 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0070 · Security Note
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07916 · Security Note
• http://redhat.com/support/errata/RHSA-2003-053.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0070 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=104612710031920&w=2 · Note
• https://rhn.redhat.com/errata/RHSA-2003-053.html · Note