Arbitrary command execution in xterm

1) Code Injection

EUVDB-ID: #VU79804

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2008-2383

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to improper input validation when parsing a text file. A local user can execute arbitrary commands on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

xterm: All versions

CPE2.3

• cpe:2.3:a:invisible-island.net:xterm:*:*:*:*:*:*:*:*

External links

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
https://secunia.com/advisories/33318
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00184.html
https://secunia.com/advisories/33419
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00072.html
https://secunia.com/advisories/33568
https://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
https://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
https://www.redhat.com/support/errata/RHSA-2009-0018.html
https://secunia.com/advisories/33418
https://secunia.com/advisories/33397
https://www.securityfocus.com/bid/33060
https://www.debian.org/security/2009/dsa-1694
https://secunia.com/advisories/33820
https://secunia.com/advisories/33388
https://sunsolve.sun.com/search/document.do?assetkey=1-66-254208-1
https://support.apple.com/kb/HT3549
https://www.us-cert.gov/cas/techalerts/TA09-133A.html
https://lists.apple.com/archives/security-announce/2009/May/msg00002.html
https://www.vupen.com/english/advisories/2009/1297
https://secunia.com/advisories/35074
https://www.redhat.com/support/errata/RHSA-2009-0019.html
https://www.securitytracker.com/id?1021522
https://exchange.xforce.ibmcloud.com/vulnerabilities/47655
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9317
https://usn.ubuntu.com/703-1/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOOVZTIABA4MIFUGTAVYWO6QXSUXSST4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3E2Q6NPKT7V4VKZMSFF4ARLRVYOG4AU/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.