Executive Summary

Informations
Name CVE-2007-3770 First vendor Publication 2007-07-15
Vendor Cve Last vendor Modification 2017-07-29

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:P/A:N)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 7.8 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The terminal_helper_execute function in terminal/terminal.c in Xfce Terminal 0.2.6 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a crafted link, as demonstrated using the "Open Link" functionality.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3770

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20457
 
Oval ID: oval:org.mitre.oval:def:20457
Title: DSA-1393-1 xfce4-terminal - insecure execution
Description: It was discovered that xfce-terminal, a terminal emulator for the xfce environment, did not correctly escape arguments passed to the processes spawned by <q>Open Link</q>. This allowed malicious links to execute arbitrary commands upon the local system.
Family: unix Class: patch
Reference(s): DSA-1393-1
CVE-2007-3770
 Version: 5
Platform(s): Debian GNU/Linux 4.0
 Product(s): xfce4-terminal
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

OpenVAS Exploits

Date Description
2009-03-23 Name : Ubuntu Update for xfce4-terminal vulnerability USN-497-1
File : nvt/gb_ubuntu_USN_497_1.nasl
2009-02-27 Name : Fedora Update for Terminal FEDORA-2007-1620
File : nvt/gb_fedora_2007_1620_Terminal_fc7.nasl
2009-02-27 Name : Fedora Update for Terminal FEDORA-2007-4385
File : nvt/gb_fedora_2007_4385_Terminal_fc7.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200708-07 (terminal)
File : nvt/glsa_200708_07.nasl
2008-01-17 Name : Debian Security Advisory DSA 1393-1 (xfce4-terminal)
File : nvt/deb_1393_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
38082 Xfce Terminal terminal/terminal.c terminal_helper_execute FunctionOpen Crafte...

Nessus® Vulnerability Scanner

Date Description
2007-11-10 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-497-1.nasl - Type : ACT_GATHER_INFO
2007-11-06 Name : The remote Fedora host is missing a security update.
File : fedora_2007-1620.nasl - Type : ACT_GATHER_INFO
2007-10-25 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1393.nasl - Type : ACT_GATHER_INFO
2007-08-13 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200708-07.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/24889
DEBIAN http://www.debian.org/security/2007/dsa-1393
GENTOO http://security.gentoo.org/glsa/glsa-200708-07.xml
MISC http://bugs.gentoo.org/show_bug.cgi?id=184886
OSVDB http://osvdb.org/38082
SECUNIA http://secunia.com/advisories/26037
http://secunia.com/advisories/26392
http://secunia.com/advisories/26418
http://secunia.com/advisories/27374
UBUNTU http://www.ubuntu.com/usn/usn-497-1
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/35379

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
Date Informations
2021-05-04 12:06:07
  • Multiple Updates
2021-04-22 01:06:40
  • Multiple Updates
2020-05-23 00:20:07
  • Multiple Updates
2017-07-29 12:02:23
  • Multiple Updates
2016-06-28 16:44:41
  • Multiple Updates
2016-04-26 16:22:15
  • Multiple Updates
2014-02-17 10:40:54
  • Multiple Updates
2013-08-21 17:18:49
  • Multiple Updates
2013-05-11 10:31:27
  • Multiple Updates