CVE-2003-0063 (GCVE-0-2003-0063)
Vulnerability from cvelistv5
Published
2004-09-01 04:00
Modified
2024-10-29 14:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-08T01:43:35.241Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "DSA-380", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.debian.org/security/2003/dsa-380" }, { "name": "RHSA-2003:067", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-067.html" }, { "name": "RHSA-2003:066", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-066.html" }, { "name": "20030224 Terminal Emulator Security Issues", "tags": [ "mailing-list", "x_transferred" ], "url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2" }, { "name": "RHSA-2003:064", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-064.html" }, { "name": "RHSA-2003:065", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-065.html" }, { "name": "6940", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.securityfocus.com/bid/6940" }, { "name": "terminal-emulator-window-title(11414)", "tags": [ "vdb-entry", "x_transferred" ], "url": "http://www.iss.net/security_center/static/11414.php" }, { "name": "20030224 Terminal Emulator Security Issues", "tags": [ "mailing-list", "x_transferred" ], "url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html" }, { "name": "[oss-security] 20240615 iTerm2 3.5.x title reporting bug", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/06/15/1" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:a:xfree86:xfree86:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "xfree86", "vendor": "xfree86", "versions": [ { "lessThanOrEqual": "4.2.0", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2003-0063", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-24T17:38:21.119752Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-29T14:05:49.769Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2003-02-24T00:00:00", "descriptions": [ { "lang": "en", "value": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-15T10:05:53.568606", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "DSA-380", "tags": [ "vendor-advisory" ], "url": "http://www.debian.org/security/2003/dsa-380" }, { "name": "RHSA-2003:067", "tags": [ "vendor-advisory" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-067.html" }, { "name": "RHSA-2003:066", "tags": [ "vendor-advisory" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-066.html" }, { "name": "20030224 Terminal Emulator Security Issues", "tags": [ "mailing-list" ], "url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2" }, { "name": "RHSA-2003:064", "tags": [ "vendor-advisory" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-064.html" }, { "name": "RHSA-2003:065", "tags": [ "vendor-advisory" ], "url": "http://www.redhat.com/support/errata/RHSA-2003-065.html" }, { "name": "6940", "tags": [ "vdb-entry" ], "url": "http://www.securityfocus.com/bid/6940" }, { "name": "terminal-emulator-window-title(11414)", "tags": [ "vdb-entry" ], "url": "http://www.iss.net/security_center/static/11414.php" }, { "name": "20030224 Terminal Emulator Security Issues", "tags": [ "mailing-list" ], "url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html" }, { "name": "[oss-security] 20240615 iTerm2 3.5.x title reporting bug", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2024/06/15/1" } ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2003-0063", "datePublished": "2004-09-01T04:00:00", "dateReserved": "2003-02-04T00:00:00", "dateUpdated": "2024-10-29T14:05:49.769Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2003-0063\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2003-03-03T05:00:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.\"},{\"lang\":\"es\",\"value\":\"El emulador de terminal xterm en XFree86 4.2.0 permite a atacantes modificar el t\u00edtulo de la ventana mediante cierta secuencia de caracter de escape y a continuaci\u00f3n insertarlo de vuelta en la linea de comando en el terminal del usuario, por ejemplo, cuando el usuario ve un fichero que contiene la secuencia maliciosa, lo que podr\u00eda permitir ejecutar comandos arbitrarios.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F33E5444-E178-4F49-BDA1-DE576D8526EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BCC09AA-AB01-4583-8052-66DBF0E1861D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43425C85-806B-4823-AD74-D0A0465FC8DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90FA67D9-8296-4534-8354-51B830DE3499\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AC4F566-5D54-4364-B5AA-F846A0C8FCEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F9D1BD9-4300-43B5-A87B-E2BF74E55C87\"}]}]}],\"references\":[{\"url\":\"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2003/dsa-380\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.iss.net/security_center/static/11414.php\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/06/15/1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-064.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-065.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-066.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-067.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/6940\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2003/dsa-380\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.iss.net/security_center/static/11414.php\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/06/15/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-064.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-065.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-066.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/6940\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}", "vulnrichment": { "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.debian.org/security/2003/dsa-380\", \"name\": \"DSA-380\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-067.html\", \"name\": \"RHSA-2003:067\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-066.html\", \"name\": \"RHSA-2003:066\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-064.html\", \"name\": \"RHSA-2003:064\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-065.html\", \"name\": \"RHSA-2003:065\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/6940\", \"name\": \"6940\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}, {\"url\": \"http://www.iss.net/security_center/static/11414.php\", \"name\": \"terminal-emulator-window-title(11414)\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}, {\"url\": \"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/15/1\", \"name\": \"[oss-security] 20240615 iTerm2 3.5.x title reporting bug\", \"tags\": [\"mailing-list\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-08T01:43:35.241Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2003-0063\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-24T17:38:21.119752Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:xfree86:xfree86:*:*:*:*:*:*:*:*\"], \"vendor\": \"xfree86\", \"product\": \"xfree86\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.2.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-24T17:39:25.055Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2003-02-24T00:00:00\", \"references\": [{\"url\": \"http://www.debian.org/security/2003/dsa-380\", \"name\": \"DSA-380\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-067.html\", \"name\": \"RHSA-2003:067\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-066.html\", \"name\": \"RHSA-2003:066\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-064.html\", \"name\": \"RHSA-2003:064\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-065.html\", \"name\": \"RHSA-2003:065\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/6940\", \"name\": \"6940\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"http://www.iss.net/security_center/static/11414.php\", \"name\": \"terminal-emulator-window-title(11414)\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/15/1\", \"name\": \"[oss-security] 20240615 iTerm2 3.5.x title reporting bug\", \"tags\": [\"mailing-list\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2024-06-15T10:05:53.568606\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2003-0063\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-29T14:05:49.769Z\", \"dateReserved\": \"2003-02-04T00:00:00\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2004-09-01T04:00:00\", \"assignerShortName\": \"mitre\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…