rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
References
Configurations
Configuration 1 (hide)
|
Information
Published : 2008-04-07 10:44
Updated : 2009-02-25 21:00
NVD link : CVE-2008-1142
Mitre link : CVE-2008-1142
JSON object : View
CWE
CWE-264
Permissions, Privileges, and Access Controls
Products Affected
mrxvt
- mrxvt
eterm
- eterm
wterm
- wterm
rxvt
- rxvt
rxvt-unicode
- rxvt-unicode
multi-aterm
- multi-aterm
aterm
- aterm