ATerm Menu Bar Escape Sequence Command Execution Vulnerability

Bugtraq ID:	6949
Class:	Design Error
CVE:	CVE-2003-0024
Remote:	Yes
Local:	No
Published:	Feb 24 2003 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	Discovery of these issues is credited to H D Moore and Digital Defense.
Vulnerable:	aterm aterm 0.4.2
Not Vulnerable:

ATerm Menu Bar Escape Sequence Command Execution Vulnerability

aterm's MenuBar feature may be abused to execute arbitrary commands. Menu items may be added to the terminal emulator which contain arbitrary commands. If this menu item is later accessed by the terminal user, the arbitrary commands may be executed.

It is possible to exploit this issue if an attacker can cause malicious escape sequences to be displayed in a terminal window of a vulnerable terminal emulator.

ATerm Menu Bar Escape Sequence Command Execution Vulnerability

There is no exploit code required.

ATerm Menu Bar Escape Sequence Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ATerm Menu Bar Escape Sequence Command Execution Vulnerability

References:

• TERMINAL EMULATOR SECURITY ISSUES (Digital Defense)
  
• Terminal Emulator Security Issues (H D Moore )