PT-2022-17008 · Unknown · Eternal Terminal

Adi-Ajit + 1 · Published 2022-08-16 · Updated 2024-06-15 · CVE-2022-24951

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eternal Terminal versions prior to 6.2.0

Description A race condition exists in Eternal Terminal, allowing a local attacker to hijack Eternal Terminal's IPC socket. This enables access to Eternal Terminal clients that attempt to connect in the future.

Recommendations For versions prior to 6.2.0, update to version 6.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the IPC socket to minimize the risk of exploitation.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2022-24951

GHSA-546V-59J5-G95Q

OPENSUSE-SU-2022:10185-1

OPENSUSE-SU-2022:10187-1

OPENSUSE-SU-2024:12269-1

Affected Products

Eternal Terminal

References · 19

• 🔥 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-546v-59j5-g95q · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:12269-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10185-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24951 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10187-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24951 · Security Note
• https://github.com/MisterTea/EternalTerminal/releases/tag/et-v6.2.0 · Note
• https://suse.com/security/cve/CVE-2022-24951 · Note
• https://bugzilla.suse.com/1202434 · Note
• https://suse.com/security/cve/CVE-2022-24950 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/OHYD4A5UEJOUE57LY64OW2WI6GAVBOMR · Note
• https://bugzilla.suse.com/1202435 · Note
• https://bugzilla.suse.com/1202433 · Note
• http://openwall.com/lists/oss-security/2023/02/16/1 · Note
• https://suse.com/security/cve/CVE-2022-24952 · Note