RE: [Full-Disclosure] Re: Terminal Emulator Security Issues

From: Steve Wray (steve.wray@paradise.net.nz)
Date: 02/25/03

  • Next message: Steve Wray: "RE: [Full-Disclosure] Security Advisory MA-2003-01 - CISSP Trojan" 
    From: "Steve Wray" <steve.wray@paradise.net.nz>
To: "'Michael Jennings'" <mej@eterm.org>, <vulnwatch@vulnwatch.org>, <bugtraq@securityfocus.com>, <full-disclosure@lists.netsys.com>
Date: Wed, 26 Feb 2003 09:32:07 +1300

    > On Monday, 24 February 2003, at 15:02:52 (-0600),
    > H D Moore wrote:
    >
    > > Eterm and rxvt both implement what they call the "screen dump"
    [snip]
    > > followed by the screen dump command.
    > >
    > > $ echo -e "\ec+ +\n\e]<Code>;/home/user/.rhosts\a"
    >
    > As you noted, this is no longer possible with the current release of
    > Eterm, which has been out for some time now. I didn't think it was
    > exploitable until, through a discussion related to this Debian bug:
    >
    > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=141374&archive=yesally destructive trojan application, which masquerades debian distro? It tends to get left behind. Sort of like end-of-life
     
    Isn't this one of the generic problems with running the stable
    debian distro? It tends to get left behind. Sort of like end-of-life
    only undeclared...

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html