PT-2003-1086 · N/A · Hanterm

Published 2003-03-18 · Updated 2016-10-18 · CVE-2003-0077

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hanterm versions 2.0.5 and earlier

Description The issue allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal. This could happen when the user views a file containing the malicious sequence, potentially allowing the attacker to execute arbitrary commands. Multiple vulnerabilities in the hanterm-xf package may lead to breaches of confidentiality, integrity, and availability of protected information, and exploitation can be done remotely.

Recommendations For versions 2.0.5 and earlier, consider disabling the handling of certain character escape sequences in the terminal emulator as a temporary workaround until a patch is available. Restrict access to potentially malicious files that could contain the harmful sequences to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-08015

CVE-2003-0077

Affected Products

Hanterm

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2003-0077 · Security Note
• http://redhat.com/support/errata/RHSA-2003-071.html · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-070.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08015 · Security Note
• http://iss.net/security_center/static/11414.php · Vendor Advisory
• http://osvdb.org/4917 · Note
• https://rhn.redhat.com/errata/RHSA-2003-070.html · Note
• http://marc.info/?l=bugtraq&m=104612710031920&w=2 · Note