PT-2007-1106 · Xfce · Xfce Terminal

Lasse Kärkkäinen · Published 2007-07-15 · Updated 2017-07-29 · CVE-2007-3770

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Xfce Terminal version 0.2.6 terminal versions prior to 0.2.6 p25931

Description: The issue allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a crafted link. This can be demonstrated using the "Open Link" functionality. Exploitation of this issue may lead to a violation of confidentiality and integrity of protected information and can be carried out remotely.

Recommendations: For Xfce Terminal version 0.2.6, consider disabling the terminal helper execute function as a temporary workaround until a patch is available. For terminal versions prior to 0.2.6 p25931, restrict access to the "Open Link" functionality to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09588

CVE-2007-3770

DSA-1393-1

Affected Products

Xfce Terminal

References · 16

• http://secunia.com/advisories/26037 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200708-07.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09588 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3770 · Vendor Advisory
• http://ubuntu.com/usn/usn-497-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-3770 · Vendor Advisory
• http://debian.org/security/2007/dsa-1393 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-3770 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3770 · Security Note
• http://secunia.com/advisories/26418 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=184886 · Note
• http://secunia.com/advisories/27374 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35379 · Note
• http://secunia.com/advisories/26392 · Note
• http://osvdb.org/38082 · Note