PT-2003-1348 · Eterm · Eterm

H D Moore · Published 2003-03-03 · Updated 2016-10-18 · CVE-2003-0068

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Eterm versions 0.9.1 and earlier

Description The issue allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal. This could happen when the user views a file containing the malicious sequence, potentially allowing the attacker to execute arbitrary commands.

Recommendations For versions 0.9.1 and earlier, consider disabling the ability to modify the window title via character escape sequences until a patch is available. Restrict the insertion of modified window titles back into the command line to minimize the risk of exploitation. Avoid viewing files that may contain malicious character escape sequences in the affected terminal emulator until the issue is resolved.

Fix

Related Identifiers

CVE-2003-0068

DSA-496

Affected Products

Eterm

References · 10

• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0068 · Vendor Advisory
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:040 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0068 · Vendor Advisory
• http://debian.org/security/2004/dsa-496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0068 · Security Note
• http://iss.net/security_center/static/11414.php · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0068 · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html · Vendor Advisory
• http://securityfocus.com/bid/10237 · Note
• http://marc.info/?l=bugtraq&m=104612710031920&w=2 · Note