CVE-2008-1692 Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack....
MediumCVSS 6.9
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eterm | = 0.9.4 | No fix listed |
| debian/eterm(Debian:12) | < 0.9.4.0debian1-2.1 | 0.9.4.0debian1-2.1 |
| debian/eterm(Debian:14) | < 0.9.4.0debian1-2.1 | 0.9.4.0debian1-2.1 |
| debian/eterm(Debian:14) | = 0.7-1 | No fix listed |
| debian/eterm(Debian:14) | = 0.8.10-10 | No fix listed |
| debian/eterm(Debian:14) | = 0.8.7-0.4 | No fix listed |
| debian/eterm(Debian:14) | = 0.8.7-0.4.1 | No fix listed |
| debian/eterm(Debian:14) | = 0.9.2-0pre2002042903 | No fix listed |
| debian/eterm(Debian:14) | = 0.9.2-0pre2002042903.3 | No fix listed |
| debian/eterm(Debian:14) | = 0.9.2-8 | No fix listed |
| debian/eterm(Debian:14) | = 0.9.2-8.1 | No fix listed |
| debian/eterm(Debian:14) | = 0.9.3-1 | No fix listed |
| debian/eterm(Debian:14) | = 0.9.4.0debian1-1 | No fix listed |
| debian/eterm(Debian:14) | = 0.9.4.0debian1-2 | No fix listed |
References
- bugs.debian.org
- 29577 third-party-advisory vendor-advisory
- GLSA-200805-03 vendor-advisory
- MDVSA-2008:222 vendor-advisory
- 28512 vdb-entry
- Debian Security Tracker CVE-2008-1692 vendor-advisory
- bugs.debian.org issue-tracking