Title: Xfce-Terminal Remote Command Injection Vulnerability
Severity: HIGH
Description:
Xfce Terminal is a terminal emulator designed for the Xfce desktop environment.
Xfce Terminal is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.
Specifically, the application fails to properly sanitize user-supplied input when it attempts to handle URIs with the 'Open Link' functionality. The 'gdk_spawn_on_screen()' function passes the user-supplied data to an 'exec' call in combination with '/bin/sh -c'. When attackers include shell metacharacters in links, they will be interpreted by the shell.
Attackers can exploit this issue to execute arbitrary commands in the context of the application, facilitating the remote compromise of affected computers.
Xfce Terminal 0.2.6 is vulnerable; other versions may also be affected.
Affected Products:
- Debian Linux 4.0
- Debian Linux 4.0 alpha
- Debian Linux 4.0 amd64
- Debian Linux 4.0 arm
- Debian Linux 4.0 hppa
- Debian Linux 4.0 ia-32
- Debian Linux 4.0 ia-64
- Debian Linux 4.0 m68k
- Debian Linux 4.0 mips
- Debian Linux 4.0 mipsel
- Debian Linux 4.0 powerpc
- Debian Linux 4.0 s/390
- Debian Linux 4.0 sparc
- Gentoo Linux
- Ubuntu Ubuntu Linux 6.06 LTS amd64
- Ubuntu Ubuntu Linux 6.06 LTS i386
- Ubuntu Ubuntu Linux 6.06 LTS powerpc
- Ubuntu Ubuntu Linux 6.06 LTS sparc
- Ubuntu Ubuntu Linux 6.10 amd64
- Ubuntu Ubuntu Linux 6.10 i386
- Ubuntu Ubuntu Linux 6.10 powerpc
- Ubuntu Ubuntu Linux 6.10 sparc
- Ubuntu Ubuntu Linux 7.04 amd64
- Ubuntu Ubuntu Linux 7.04 i386
- Ubuntu Ubuntu Linux 7.04 powerpc
- Ubuntu Ubuntu Linux 7.04 sparc
- Xfce Xfce-Terminal 0.2.6
References:
- Gentoo: Bugzilla Bug 184886
- Xfce: Bug 3383 - Terminal-0.2.6, URL handling allows remote shell command execution
- Xfce: Xfce Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
