CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-3746647cc3 advisory.

    fixes CVE-2008-2383

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a004ecb3f8 advisory.

    version 0.29.1     fixes CVE-2008-2383



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2009:0018 :

An updated xterm package to correct a security issue is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The xterm program is a terminal emulator for the X Window System.

A flaw was found in the xterm handling of Device Control Request Status String (DECRQSS) escape sequences. An attacker could create a malicious text file (or log entry, if unfiltered) that could run arbitrary commands if read by a victim inside an xterm window.
(CVE-2008-2383)

All xterm users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. All running instances of xterm must be restarted for the update to take effect.

A flaw was found in the xterm handling of Device Control Request Status String (DECRQSS) escape sequences. An attacker could create a malicious text file (or log entry, if unfiltered) that could run arbitrary commands if read by a victim inside an xterm window.
(CVE-2008-2383)

XTerm evaluated various ANSI Escape sequences so that command execution was possible if an attacker could pipe raw data to an xterm.
(CVE-2008-2383)

(It is usually not recommended to display raw data on an xterm.)

XTerm evaluated various ANSI Escape sequences so that command execution was possible if an attacker could pipe raw data to an xterm.
(CVE-2008-2383) (It is usually not recommended to display raw data on an xterm.)

Support for Matrox G200EV/G200WB cards was added.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

Paul Szabo discovered that the DECRQSS escape sequences were not handled correctly by xterm. Additionally, window title operations were also not safely handled. If a user were tricked into viewing a specially crafted series of characters while in xterm, a remote attacker could execute arbitrary commands with user privileges.
(CVE-2006-7236, CVE-2008-2382).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute arbitrary shell commands by e.g. tricking a user into displaying a malicious text file containing a specially crafted escape sequence via the more command in xterm (CVE-2008-2383).

The updated packages have been patched to prevent this.

New xterm packages are available for Slackware 12.0, 12.1, 12.2, and
-current to fix a security issue.

The remote host is affected by the vulnerability described in GLSA-200902-04 (xterm: User-assisted arbitrary commands execution)

    Paul Szabo reported an insufficient input sanitization when processing     Device Control Request Status String (DECRQSS) sequences.
  Impact :

    A remote attacker could entice a user to display a file containing     specially crafted DECRQSS sequences, possibly resulting in the remote     execution of arbitrary commands with the privileges of the user viewing     the file.
  Workaround :

    There is no known workaround at this time.

This update fixes the following security issue: CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated hanterm-xf package to correct a security issue is now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Hanterm is a replacement for xterm, a X Window System terminal emulator, that supports Hangul input and output.

A flaw was found in the Hanterm handling of Device Control Request Status String (DECRQSS) escape sequences. An attacker could create a malicious text file (or log entry, if unfiltered) that could run arbitrary commands if read by a victim inside a Hanterm window.
(CVE-2008-2383)

All hanterm-xf users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. All running instances of hanterm must be restarted for the update to take effect.

An updated xterm package to correct a security issue is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The xterm program is a terminal emulator for the X Window System.

A flaw was found in the xterm handling of Device Control Request Status String (DECRQSS) escape sequences. An attacker could create a malicious text file (or log entry, if unfiltered) that could run arbitrary commands if read by a victim inside an xterm window.
(CVE-2008-2383)

All xterm users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. All running instances of xterm must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:0018 advisory.

  - xterm: arbitrary command injection (CVE-2008-2383)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SecurityFocus reports :

The xterm program is prone to a remote command-execution vulnerability because it fails to sufficiently validate user input.

Successfully exploiting this issue would allow an attacker to execute arbitrary commands on an affected computer in the context of the affected application.

Paul Szabo discovered that xterm, a terminal emulator for the X Window System, places arbitrary characters into the input buffer when displaying certain crafted escape sequences (CVE-2008-2383 ).

As an additional precaution, this security update also disables font changing, user-defined keys, and X property changes through escape sequences.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Severity
178936	Fedora 37 : kitty (2023-3746647cc3)	Nessus	Fedora Local Security Checks	critical
178790	Fedora 38 : kitty (2023-a004ecb3f8)	Nessus	Fedora Local Security Checks	critical
67791	Oracle Linux 3 / 4 / 5 : xterm (ELSA-2009-0018)	Nessus	Oracle Linux Local Security Checks	high
60516	Scientific Linux Security Update : xterm on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41604	SuSE 10 Security Update : xterm (ZYPP Patch Number 5898)	Nessus	SuSE Local Security Checks	high
41274	SuSE9 Security Update : XFree86 (YOU Patch Number 12344)	Nessus	SuSE Local Security Checks	high
40327	openSUSE Security Update : xterm (xterm-405)	Nessus	SuSE Local Security Checks	high
40160	openSUSE Security Update : xterm (xterm-405)	Nessus	SuSE Local Security Checks	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
37162	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : xterm vulnerabilities (USN-703-1)	Nessus	Ubuntu Local Security Checks	high
36977	Mandriva Linux Security Advisory : xterm (MDVSA-2009:005)	Nessus	Mandriva Local Security Checks	high
35827	Slackware 12.0 / 12.1 / 12.2 / current : xterm (SSA:2009-069-03)	Nessus	Slackware Local Security Checks	high
35675	GLSA-200902-04 : xterm: User-assisted arbitrary commands execution	Nessus	Gentoo Local Security Checks	high
35391	Fedora 8 : xterm-238-1.fc8 (2009-0154)	Nessus	Fedora Local Security Checks	high
35388	Fedora 9 : xterm-238-1.fc9 (2009-0059)	Nessus	Fedora Local Security Checks	high
35369	openSUSE 10 Security Update : xterm (xterm-5902)	Nessus	SuSE Local Security Checks	high
35319	RHEL 2.1 : hanterm-xf (RHSA-2009:0019)	Nessus	Red Hat Local Security Checks	high
35312	CentOS 3 / 4 / 5 : xterm (CESA-2009:0018)	Nessus	CentOS Local Security Checks	high
35302	RHEL 4 / 5 : xterm (RHSA-2009:0018)	Nessus	Red Hat Local Security Checks	critical
35295	FreeBSD : xterm -- DECRQSS remote command execution vulnerability (d5e1aac8-db0b-11dd-ae30-001cc0377035)	Nessus	FreeBSD Local Security Checks	high
35293	Debian DSA-1694-1 : xterm - design flaw	Nessus	Debian Local Security Checks	high
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2008-2383

critical

Tenable Plugins

critical

critical

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

critical

high

high

critical

high