Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2010:161 | First vendor Publication | 2010-08-24 |
| Vendor | Mandriva | Last vendor Modification | 2010-08-24 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability has been found and corrected in vte: The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence. NOTE: this issue exists because of a CVE-2003-0070 regression (CVE-2010-2713). The updated packages have been patched to correct this issue. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2010:161 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13372 | |||
| Oval ID: | oval:org.mitre.oval:def:13372 | ||
| Title: | USN-962-1 -- vte vulnerability | ||
| Description: | Janne Snabb discovered that applications using VTE, such as gnome-terminal, did not correctly filter window and icon title request escape codes. If a user were tricked into viewing specially crafted output in their terminal, a remote attacker could execute arbitrary commands with user privileges. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-962-1 CVE-2010-2713 | Version: | 5 |
| Platform(s): | Ubuntu 10.04 Ubuntu 9.04 Ubuntu 9.10 | Product(s): | vte |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-08-30 | Name : Mandriva Update for vte MDVSA-2010:161 (vte) File : nvt/gb_mandriva_MDVSA_2010_161.nasl |
| 2010-07-22 | Name : FreeBSD Ports: vte File : nvt/freebsd_vte.nasl |
| 2010-07-16 | Name : Ubuntu Update for vte vulnerability USN-962-1 File : nvt/gb_ubuntu_USN_962_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 60458 | VTE / gnome-terminal Window Title Escape Sequence Arbitrary Command Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-10.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_vte-100716.nasl - Type : ACT_GATHER_INFO |
| 2011-01-21 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_vte-100715.nasl - Type : ACT_GATHER_INFO |
| 2010-08-25 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-161.nasl - Type : ACT_GATHER_INFO |
| 2010-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_vte-100716.nasl - Type : ACT_GATHER_INFO |
| 2010-07-19 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_9a8fecef92c011dfb1400015f2db7bde.nasl - Type : ACT_GATHER_INFO |
| 2010-07-16 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-962-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:41:40 |
|
