Multiple terminal clients X sessions hijack

Terminal always opens :0 display if DISPLAY is not set...

Multiple X11 terminals: Local privilege escalation

Background Aterm, Eterm, Mrxvt, multi-aterm, RXVT, rxvt-unicode, and wterm are X11 terminal emulators. Description Bernhard R. Link discovered that RXVT opens a terminal on :0 if the "-display" option is not specified and the DISPLAY environment variable is not set. Further research by the Gentoo...

Debian DSA-1561-1 : ldm - programming error

Christian Herzog discovered that within the Linux Terminal Server Project, it was possible to connect to X on any LTSP client from any host on the network, making client windows and keystrokes visible to that host. NOTE: most ldm installs are likely to be in a chroot environment exported over NFS...

DEBIAN-CVE-2008-1293

ldm in Linux Terminal Server Project LTSP 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 aka display :6...

Code injection

ldm in Linux Terminal Server Project LTSP 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 aka display :6...

CVE-2008-1293

ldm in Linux Terminal Server Project LTSP 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 aka display :6...

CVE-2008-1293

ldm in Linux Terminal Server Project LTSP 0.99 and 2 passes the -ac option to the X server on each LTSP client, which allows remote attackers to connect to this server via TCP port 6006 aka display :6...

CVE-2008-1293

The CVE-2008-1293 entry describes a vulnerability in LTSP’s ldm where -ac is passed to the X server on LTSP clients, enabling a remote attacker to connect to the client X display (display :6, TCP port 6006) and potentially observe/record keystrokes. Connected advisories (Ubuntu USN-610-1, Debian ...

DSA-1561-1 ltsp - information disclosure

Bulletin has no description...

CVE-2008-1994

Multiple stack-based buffer overflows in a acon.c, b menu.c, and c child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via 1 a long HOME environment variable or 2 a large number of terminal columns...

Stack overflow

Multiple stack-based buffer overflows in a acon.c, b menu.c, and c child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via 1 a long HOME environment variable or 2 a large number of terminal columns...

CVE-2008-1994

Multiple stack-based buffer overflows in a acon.c, b menu.c, and c child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via 1 a long HOME environment variable or 2 a large number of terminal columns...

CVE-2008-1994

Multiple stack-based buffer overflows in a acon.c, b menu.c, and c child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execute arbitrary code via 1 a long HOME environment variable or 2 a large number of terminal columns...

Attack Trojans-remote control software of its own vulnerability to your attention?-vulnerability warning-the black bar safety net

from:sowhat blog Two days before the RSA conference, there was a guy named Joel Eriksson researchers show how to attack the Trojans, particularly the Trojan control terminalto control the“hacker”. blog.wired.com/27bstroke6/2008/04/researcher-demo.html Eriksson found one in the Celestial Empire on...

CVE-2008-1845

The Korn shell aka mksh before R33d on MirOS aka MirBSD does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a...

Design/Logic Flaw

The Korn shell aka mksh before R33d on MirOS aka MirBSD does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a...

DEBIAN-CVE-2008-1845

The Korn shell aka mksh before R33d on MirOS aka MirBSD does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a...

CVE-2008-1845

The Korn shell aka mksh before R33d on MirOS aka MirBSD does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a...

CVE-2008-1692

CVE-2008-1692 affects several X11 terminal emulators (Eterm 0.9.4; and also aterm, rxvt, rxvt-unicode, wterm, Mrxvt, multi-aterm) used on X displays. The root cause is that Eterm opens a :0 terminal when -display is not provided and DISPLAY is unset, enabling a local attacker to hijack X11 termin...

CVE-2008-1692

Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine...