CVE-2003-0070 regression

[Marc Deslauriers]

Received by the security team:

Hello,

I was testing several different terminal emulators for an old
well-known vulnerability.

I noticed that gnome-terminal which is installed as the default
terminal emulator application on Ubuntu 9.10 Netbook Edition is
vulnerable to the old terminal title set+query attack. This
vulnerability comes from the VTE library being used. I assume that
other Ubuntu versions are vulnerable as well.

Users who display data from untrusted sources within a terminal
window are exposed. This can happen for example by using "cat"
command to display a file from an untrusted source or by using "tail
-f" to monitor system log files.

See the following URLs for more details:

http://xforce.iss.net/xforce/xfdb/11414
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0070
http://marc.info/?l=bugtraq&m=104612710031920&w=2
http://www.securityfocus.com/bid/6948

This is a funny bug. It has existed "forever" (since early 90's at
least) and been fixed multiple times, but it re-surfaces always
again somewhere after a couple of years have passed.

Please note that setting the terminal title is a desired feature,
but querying it with an escape code should be disabled by default
to prevent exploitation.

[Marc Deslauriers (mdeslaur)]

CRD is 2010-07-15

[Marc Deslauriers (mdeslaur)]

Commit that reintroduced the vulnerability:

http://git.gnome.org/browse/vte/commit/?id=58bc3a942f198a1a8788553ca72c19d7c1702b74

[Jamie Strandboge (jdstrand)]

This is fixed in 0.25.90 and http://www.ubuntu.com/usn/usn-962-1.