Terminal Programs Set Incorrect Terminal Permissions Vulnerability

Bugtraq ID:	309
Class:	Unknown
CVE:	CVE-2000-0364
Remote:	No
Local:	Yes
Published:	Jun 06 1999 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	This vulnerability was discovered in a discussion among several subscribers of the BUGTRAQ mailing list.
Vulnerable:	Redhat Linux 6.0
Not Vulnerable:

Terminal Programs Set Incorrect Terminal Permissions Vulnerability

A vulnerabilitity in the rxvt and screen terminal programs makes the set permission that are to broad on the terminal. This allows local malicious user to write to the terminal.

This is RedHat Bug ID 3025.

Terminal Programs Set Incorrect Terminal Permissions Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Terminal Programs Set Incorrect Terminal Permissions Vulnerability

Solution:
Upgrade to the following RPMs made available by RedHat:

Intel: ftp://updates.redhat.com/6.0/i386/

rxvt-2.6.0-2.i386.rpm
screen-3.7.6-9.i386.rpm

Alpha: ftp://updates.redhat.com/6.0/alpha/

rxvt-2.6.0-2.alpha.rpm
screen-3.7.6-9.alpha.rpm

Sparc: ftp://updates.redhat.com/6.0/sparc/

rxvt-2.6.0-2.sparc.rpm
screen-3.7.6-9.sparc.rpm

Terminal Programs Set Incorrect Terminal Permissions Vulnerability

References:

• Bugzilla Bug 3025 (RedHat)