Vulnerability CVE-2008-1142 - CERT Civis.Net

Vulnerability Name:

CVE-2008-1142 (CCN-41539)

Assigned:

2008-03-28

Published:

2008-03-28

Updated:

2009-02-26

Summary:

rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.
Note: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected.
Note: realistic attack scenarios require that the victim enters a command on the wrong machine.

CVSS v3 Severity:

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

3.7 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P)
2.7 Low (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
3.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: CCN
Type: gmane Security Advisory, 2008-03-06 21:05:14 GMT
Attack vector exploiting rxvt defaulting to :0

Source: MISC
Type: UNKNOWN
http://article.gmane.org/gmane.comp.security.oss.general/122

Source: CONFIRM
Type: Vendor Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296

Source: CCN
Type: Debian Bug report logs - #473127
eterm: opens window on unspecified display

Source: MITRE
Type: CNA
CVE-2008-1142

Source: MITRE
Type: CNA
CVE-2008-1692

Source: SUSE
Type: UNKNOWN
SUSE-SR:2008:017

Source: CCN
Type: SA29576
rxvt X11 Display Security Issue

Source: SECUNIA
Type: Vendor Advisory
29576

Source: CCN
Type: SA29577
Eterm X11 Display Security Issue

Source: CCN
Type: SA30224
rxvt-unicode X11 Display Security Issue

Source: SECUNIA
Type: Vendor Advisory
30224

Source: CCN
Type: SA30225
aterm X11 Display Security Issue

Source: SECUNIA
Type: Vendor Advisory
30225

Source: CCN
Type: SA30226
wterm X11 Display Security Issue

Source: SECUNIA
Type: Vendor Advisory
30226

Source: CCN
Type: SA30227
mrxvt X11 Display Security Issue

Source: SECUNIA
Type: Vendor Advisory
30227

Source: SECUNIA
Type: Vendor Advisory
30229

Source: SECUNIA
Type: Vendor Advisory
31687

Source: GENTOO
Type: UNKNOWN
GLSA-200805-03

Source: CCN
Type: Eterm Web site
Eterm.Org

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:161

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:221

Source: CCN
Type: OSVDB ID: 43902
rxvt X11 :0 Default Display Local Privilege Escalation

Source: CCN
Type: OSVDB ID: 43903
Eterm X11 :0 Default Display Local Privilege Escalation

Source: CCN
Type: OSVDB ID: 45081
aterm X11 :0 Default Display Local Privilege Escalation

Source: CCN
Type: OSVDB ID: 45082
mrxvt X11 :0 Default Display Local Privilege Escalation

Source: CCN
Type: OSVDB ID: 45083
rxvt-unicode X11 :0 Default Display Local Privilege Escalation

Source: CCN
Type: OSVDB ID: 45084
wterm X11 :0 Default Display Local Privilege Escalation

Source: CCN
Type: rxvt Web site
ouR eXtended Virtual Terminal

Source: BID
Type: Patch
28512

Source: CCN
Type: BID-28512
Multiple X11 Terminals Missing DISPLAY Variable Local Arbitrary Command Execution Vulnerability

Source: XF
Type: UNKNOWN
terminalemulator-x11-privilege-escalation(41539)

Source: SUSE
Type: SUSE-SR:2008:017
SUSE Security Summary Report

Vulnerable Configuration:

Configuration 1:

cpe:/a:aterm:aterm:0.1.0:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.1.1:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.2.0:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.3.0:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.3.1:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.3.2:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.3.3:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.3.4:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.3.5:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.3.6:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.4.0:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.4.1:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:0.4.2:*:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:1.00:beta1:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:1.00:beta2:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:1.00:beta3:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:1.00:beta4:*:*:*:*:*:*

OR cpe:/a:aterm:aterm:*:*:*:*:*:*:*:* (Version <= 1.0.0)

OR cpe:/a:eterm:eterm:0.9.2:*:*:*:*:*:*:*

OR cpe:/a:eterm:eterm:*:*:*:*:*:*:*:* (Version <= 0.9.3)

OR cpe:/a:mrxvt:mrxvt:0.4.2:*:*:*:*:*:*:*

OR cpe:/a:mrxvt:mrxvt:*:*:*:*:*:*:*:* (Version <= 0.5.2)

OR cpe:/a:multi-aterm:multi-aterm:0.0.1:*:*:*:*:*:*:*

OR cpe:/a:multi-aterm:multi-aterm:0.0.3:*:*:*:*:*:*:*

OR cpe:/a:multi-aterm:multi-aterm:0.0.4:*:*:*:*:*:*:*

OR cpe:/a:multi-aterm:multi-aterm:0.0.5:*:*:*:*:*:*:*

OR cpe:/a:multi-aterm:multi-aterm:0.1:*:*:*:*:*:*:*

OR cpe:/a:multi-aterm:multi-aterm:*:*:*:*:*:*:*:* (Version <= 0.2)

OR cpe:/a:rxvt:rxvt:2.6.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:2.6.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:2.6.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:2.6.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:2.7.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:2.7.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:2.7.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:2.7.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt:rxvt:*:*:*:*:*:*:*:* (Version <= 2.7.9)

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.9:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:1.91:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:2.9:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:3.9:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:4.9:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:5.9:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:6.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:6.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:6.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:6.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:7.9:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.1:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.2:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.3:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.4:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.5:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.5a:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.6:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.7:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.8:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:8.9:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:9.0:*:*:*:*:*:*:*

OR cpe:/a:rxvt-unicode:rxvt-unicode:*:*:*:*:*:*:*:* (Version <= 9.01)

OR cpe:/a:wterm:wterm:6.2.5:*:*:*:*:*:*:*

OR cpe:/a:wterm:wterm:6.2.6:*:*:*:*:*:*:*

OR cpe:/a:wterm:wterm:*:*:*:*:*:*:*:* (Version <= 6.2.8a2)

Configuration CCN 1:

cpe:/a:rxvt:rxvt:2.6.4:*:*:*:*:*:*:*

AND

cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:x86_64:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20081142	V	CVE-2008-1142	2022-06-30
oval:org.opensuse.security:def:113417	P	rxvt-unicode-9.22-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106819	P	rxvt-unicode-9.22-1.1 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:26128	P	Security update for postgresql13 (Moderate)	2021-09-16
oval:org.opensuse.security:def:26116	P	Security update for apache2 (Important)	2021-09-02
oval:org.opensuse.security:def:26117	P	Security update for xen (Important)	2021-09-02
oval:org.opensuse.security:def:36567	P	rxvt-unicode-9.05-1.19.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:26192	P	Security update for php72 (Important)	2021-02-17
oval:org.opensuse.security:def:26892	P	expat on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26458	P	Security update for phpMyAdmin (Moderate)	2020-12-01
oval:org.opensuse.security:def:26795	P	opie on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:27530	P	pam-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26542	P	evolution-data-server on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26834	P	tomcat6 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26320	P	Security update to go1.4 (Low)	2020-12-01
oval:org.opensuse.security:def:27565	P	rxvt-unicode on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26693	P	evolution-data-server on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26848	P	yast2-core on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:26401	P	Security update for chromium (Important)	2020-12-01
oval:org.opensuse.security:def:26746	P	libfreebl3 on GA media (Moderate)	2020-12-01