#VU79804 Code Injection in xterm - CVE-2008-2383
Vulnerability identifier: #VU79804
Vulnerability risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-94
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
xterm
Other software /
Other software solutions
Vendor: invisible-island.net
Description
The vulnerability allows a local user to compromise the affected system.
The vulnerability exists due to improper input validation when parsing a text file. A local user can execute arbitrary commands on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
xterm: All versions
External links
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
https://secunia.com/advisories/33318
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00184.html
https://secunia.com/advisories/33419
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00072.html
https://secunia.com/advisories/33568
https://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
https://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
https://www.redhat.com/support/errata/RHSA-2009-0018.html
https://secunia.com/advisories/33418
https://secunia.com/advisories/33397
https://www.securityfocus.com/bid/33060
https://www.debian.org/security/2009/dsa-1694
https://secunia.com/advisories/33820
https://secunia.com/advisories/33388
https://sunsolve.sun.com/search/document.do?assetkey=1-66-254208-1
https://support.apple.com/kb/HT3549
https://www.us-cert.gov/cas/techalerts/TA09-133A.html
https://lists.apple.com/archives/security-announce/2009/May/msg00002.html
https://www.vupen.com/english/advisories/2009/1297
https://secunia.com/advisories/35074
https://www.redhat.com/support/errata/RHSA-2009-0019.html
https://www.securitytracker.com/id?1021522
https://exchange.xforce.ibmcloud.com/vulnerabilities/47655
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9317
https://usn.ubuntu.com/703-1/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOOVZTIABA4MIFUGTAVYWO6QXSUXSST4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3E2Q6NPKT7V4VKZMSFF4ARLRVYOG4AU/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
