CVE-2008-1142
First published: Mon Apr 07 2008(Updated: )
rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rxvt-unicode Rxvt-unicode | =2.5 | |
| Aterm Aterm | =0.3.1 | |
| Rxvt Rxvt | =2.7.5 | |
| Rxvt-unicode Rxvt-unicode | <=9.01 | |
| Multi-aterm Multi-aterm | =0.0.5 | |
| Aterm Aterm | =1.00-beta4 | |
| Rxvt-unicode Rxvt-unicode | =1.3 | |
| Rxvt-unicode Rxvt-unicode | =3.4 | |
| Rxvt-unicode Rxvt-unicode | =5.1 | |
| Rxvt-unicode Rxvt-unicode | =7.2 | |
| Rxvt-unicode Rxvt-unicode | =2.3 | |
| Rxvt-unicode Rxvt-unicode | =3.1 | |
| Rxvt-unicode Rxvt-unicode | =1.8 | |
| Rxvt-unicode Rxvt-unicode | =5.0 | |
| Rxvt-unicode Rxvt-unicode | =3.9 | |
| Rxvt-unicode Rxvt-unicode | =4.0 | |
| Rxvt-unicode Rxvt-unicode | =7.1 | |
| Rxvt-unicode Rxvt-unicode | =5.5 | |
| Rxvt-unicode Rxvt-unicode | =6.2 | |
| Rxvt Rxvt | <=2.7.9 | |
| Multi-aterm Multi-aterm | =0.0.1 | |
| Rxvt Rxvt | =2.6.4 | |
| Rxvt-unicode Rxvt-unicode | =5.4 | |
| Rxvt-unicode Rxvt-unicode | =7.0 | |
| Aterm Aterm | =0.3.3 | |
| Rxvt-unicode Rxvt-unicode | =2.8 | |
| Aterm Aterm | =1.00-beta1 | |
| Aterm Aterm | =0.4.0 | |
| Rxvt-unicode Rxvt-unicode | =4.2 | |
| Multi-aterm Multi-aterm | <=0.2 | |
| Rxvt-unicode Rxvt-unicode | =2.0 | |
| Rxvt-unicode Rxvt-unicode | =8.1 | |
| Rxvt-unicode Rxvt-unicode | =5.3 | |
| Rxvt Rxvt | =2.7.8 | |
| Rxvt Rxvt | =2.6.1 | |
| Aterm Aterm | =0.1.0 | |
| Rxvt-unicode Rxvt-unicode | =1.0 | |
| Rxvt-unicode Rxvt-unicode | =1.91 | |
| Aterm Aterm | <=1.0.0 | |
| Aterm Aterm | =1.00-beta3 | |
| Rxvt-unicode Rxvt-unicode | =5.6 | |
| Rxvt-unicode Rxvt-unicode | =2.6 | |
| Eterm Eterm | <=0.9.3 | |
| Rxvt-unicode Rxvt-unicode | =7.7 | |
| Rxvt-unicode Rxvt-unicode | =3.3 | |
| Rxvt-unicode Rxvt-unicode | =7.5 | |
| Rxvt-unicode Rxvt-unicode | =2.4 | |
| Rxvt-unicode Rxvt-unicode | =8.3 | |
| Rxvt-unicode Rxvt-unicode | =7.8 | |
| Rxvt-unicode Rxvt-unicode | =4.4 | |
| Aterm Aterm | =0.3.6 | |
| Rxvt Rxvt | =2.7.6 | |
| Rxvt-unicode Rxvt-unicode | =4.3 | |
| Aterm Aterm | =0.3.4 | |
| Aterm Aterm | =0.1.1 | |
| Aterm Aterm | =0.3.0 | |
| Multi-aterm Multi-aterm | =0.1 | |
| Rxvt-unicode Rxvt-unicode | =1.5 | |
| Rxvt-unicode Rxvt-unicode | =8.9 | |
| Mrxvt Mrxvt | =0.4.2 | |
| Rxvt-unicode Rxvt-unicode | =8.8 | |
| Rxvt-unicode Rxvt-unicode | =2.1 | |
| Rxvt-unicode Rxvt-unicode | =3.2 | |
| Rxvt Rxvt | =2.7.7 | |
| Multi-aterm Multi-aterm | =0.0.3 | |
| Rxvt-unicode Rxvt-unicode | =2.2 | |
| Rxvt-unicode Rxvt-unicode | =4.8 | |
| Rxvt-unicode Rxvt-unicode | =1.1 | |
| Rxvt-unicode Rxvt-unicode | =6.3 | |
| Rxvt-unicode Rxvt-unicode | =4.7 | |
| Wterm Wterm | <=6.2.8a2 | |
| Rxvt-unicode Rxvt-unicode | =5.8 | |
| Aterm Aterm | =0.3.2 | |
| Mrxvt Mrxvt | <=0.5.2 | |
| Eterm Eterm | =0.9.2 | |
| Rxvt-unicode Rxvt-unicode | =3.6 | |
| Wterm Wterm | =6.2.6 | |
| Rxvt-unicode Rxvt-unicode | =5.9 | |
| Rxvt-unicode Rxvt-unicode | =3.8 | |
| Rxvt-unicode Rxvt-unicode | =8.5 | |
| Rxvt-unicode Rxvt-unicode | =8.4 | |
| Rxvt-unicode Rxvt-unicode | =1.6 | |
| Rxvt-unicode Rxvt-unicode | =4.5 | |
| Rxvt-unicode Rxvt-unicode | =3.7 | |
| Rxvt-unicode Rxvt-unicode | =4.1 | |
| Rxvt-unicode Rxvt-unicode | =8.7 | |
| Rxvt-unicode Rxvt-unicode | =6.0 | |
| Aterm Aterm | =0.4.1 | |
| Wterm Wterm | =6.2.5 | |
| Multi-aterm Multi-aterm | =0.0.4 | |
| Rxvt Rxvt | =2.6.2 | |
| Rxvt-unicode Rxvt-unicode | =7.3 | |
| Aterm Aterm | =0.3.5 | |
| Rxvt-unicode Rxvt-unicode | =2.7 | |
| Aterm Aterm | =0.2.0 | |
| Rxvt-unicode Rxvt-unicode | =8.5a | |
| Aterm Aterm | =1.00-beta2 | |
| Rxvt-unicode Rxvt-unicode | =5.2 | |
| Rxvt-unicode Rxvt-unicode | =6.1 | |
| Aterm Aterm | =0.4.2 | |
| Rxvt-unicode Rxvt-unicode | =8.6 | |
| Rxvt Rxvt | =2.6.3 | |
| Rxvt-unicode Rxvt-unicode | =4.9 | |
| Rxvt-unicode Rxvt-unicode | =1.7 | |
| Rxvt-unicode Rxvt-unicode | =2.9 | |
| Rxvt-unicode Rxvt-unicode | =7.4 | |
| Rxvt-unicode Rxvt-unicode | =9.0 | |
| Rxvt-unicode Rxvt-unicode | =7.9 | |
| Rxvt-unicode Rxvt-unicode | =7.6 | |
| Rxvt-unicode Rxvt-unicode | =8.2 | |
| Rxvt-unicode Rxvt-unicode | =5.7 | |
| Rxvt-unicode Rxvt-unicode | =4.6 | |
| Rxvt-unicode Rxvt-unicode | =3.5 | |
| Rxvt-unicode Rxvt-unicode | =8.0 | |
| Rxvt-unicode Rxvt-unicode | =3.0 | |
| Rxvt-unicode Rxvt-unicode | =1.4 | |
| Rxvt-unicode Rxvt-unicode | =1.9 | |
| Rxvt-unicode Rxvt-unicode | =1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://article.gmane.org/gmane.comp.security.oss.general/122
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296
- http://secunia.com/advisories/29576
- http://security.gentoo.org/glsa/glsa-200805-03.xml
- http://secunia.com/advisories/30224
- http://secunia.com/advisories/30225
- http://secunia.com/advisories/30226
- http://secunia.com/advisories/30227
- http://secunia.com/advisories/30229
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:161
- http://secunia.com/advisories/31687
- http://www.securityfocus.com/bid/28512
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:221
- collector/nvd-historical
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/rxvt-unicode
- canonical/rxvt-unicode rxvt-unicode
- version/rxvt-unicode rxvt-unicode/2.5
- vendor/aterm
- canonical/aterm aterm
- version/aterm aterm/0.3.1
- vendor/rxvt
- canonical/rxvt rxvt
- version/rxvt rxvt/2.7.5
- version/rxvt-unicode rxvt-unicode/9.01
- vendor/multi-aterm
- canonical/multi-aterm multi-aterm
- version/multi-aterm multi-aterm/0.0.5
- version/aterm aterm/1.00-beta4
- version/rxvt-unicode rxvt-unicode/1.3
- version/rxvt-unicode rxvt-unicode/3.4
- version/rxvt-unicode rxvt-unicode/5.1
- version/rxvt-unicode rxvt-unicode/7.2
- version/rxvt-unicode rxvt-unicode/2.3
- version/rxvt-unicode rxvt-unicode/3.1
- version/rxvt-unicode rxvt-unicode/1.8
- version/rxvt-unicode rxvt-unicode/5.0
- version/rxvt-unicode rxvt-unicode/3.9
- version/rxvt-unicode rxvt-unicode/4.0
- version/rxvt-unicode rxvt-unicode/7.1
- version/rxvt-unicode rxvt-unicode/5.5
- version/rxvt-unicode rxvt-unicode/6.2
- version/rxvt rxvt/2.7.9
- version/multi-aterm multi-aterm/0.0.1
- version/rxvt rxvt/2.6.4
- version/rxvt-unicode rxvt-unicode/5.4
- version/rxvt-unicode rxvt-unicode/7.0
- version/aterm aterm/0.3.3
- version/rxvt-unicode rxvt-unicode/2.8
- version/aterm aterm/1.00-beta1
- version/aterm aterm/0.4.0
- version/rxvt-unicode rxvt-unicode/4.2
- version/multi-aterm multi-aterm/0.2
- version/rxvt-unicode rxvt-unicode/2.0
- version/rxvt-unicode rxvt-unicode/8.1
- version/rxvt-unicode rxvt-unicode/5.3
- version/rxvt rxvt/2.7.8
- version/rxvt rxvt/2.6.1
- version/aterm aterm/0.1.0
- version/rxvt-unicode rxvt-unicode/1.0
- version/rxvt-unicode rxvt-unicode/1.91
- version/aterm aterm/1.0.0
- version/aterm aterm/1.00-beta3
- version/rxvt-unicode rxvt-unicode/5.6
- version/rxvt-unicode rxvt-unicode/2.6
- vendor/eterm
- canonical/eterm eterm
- version/eterm eterm/0.9.3
- version/rxvt-unicode rxvt-unicode/7.7
- version/rxvt-unicode rxvt-unicode/3.3
- version/rxvt-unicode rxvt-unicode/7.5
- version/rxvt-unicode rxvt-unicode/2.4
- version/rxvt-unicode rxvt-unicode/8.3
- version/rxvt-unicode rxvt-unicode/7.8
- version/rxvt-unicode rxvt-unicode/4.4
- version/aterm aterm/0.3.6
- version/rxvt rxvt/2.7.6
- version/rxvt-unicode rxvt-unicode/4.3
- version/aterm aterm/0.3.4
- version/aterm aterm/0.1.1
- version/aterm aterm/0.3.0
- version/multi-aterm multi-aterm/0.1
- version/rxvt-unicode rxvt-unicode/1.5
- version/rxvt-unicode rxvt-unicode/8.9
- vendor/mrxvt
- canonical/mrxvt mrxvt
- version/mrxvt mrxvt/0.4.2
- version/rxvt-unicode rxvt-unicode/8.8
- version/rxvt-unicode rxvt-unicode/2.1
- version/rxvt-unicode rxvt-unicode/3.2
- version/rxvt rxvt/2.7.7
- version/multi-aterm multi-aterm/0.0.3
- version/rxvt-unicode rxvt-unicode/2.2
- version/rxvt-unicode rxvt-unicode/4.8
- version/rxvt-unicode rxvt-unicode/1.1
- version/rxvt-unicode rxvt-unicode/6.3
- version/rxvt-unicode rxvt-unicode/4.7
- vendor/wterm
- canonical/wterm wterm
- version/wterm wterm/6.2.8a2
- version/rxvt-unicode rxvt-unicode/5.8
- version/aterm aterm/0.3.2
- version/mrxvt mrxvt/0.5.2
- version/eterm eterm/0.9.2
- version/rxvt-unicode rxvt-unicode/3.6
- version/wterm wterm/6.2.6
- version/rxvt-unicode rxvt-unicode/5.9
- version/rxvt-unicode rxvt-unicode/3.8
- version/rxvt-unicode rxvt-unicode/8.5
- version/rxvt-unicode rxvt-unicode/8.4
- version/rxvt-unicode rxvt-unicode/1.6
- version/rxvt-unicode rxvt-unicode/4.5
- version/rxvt-unicode rxvt-unicode/3.7
- version/rxvt-unicode rxvt-unicode/4.1
- version/rxvt-unicode rxvt-unicode/8.7
- version/rxvt-unicode rxvt-unicode/6.0
- version/aterm aterm/0.4.1
- version/wterm wterm/6.2.5
- version/multi-aterm multi-aterm/0.0.4
- version/rxvt rxvt/2.6.2
- version/rxvt-unicode rxvt-unicode/7.3
- version/aterm aterm/0.3.5
- version/rxvt-unicode rxvt-unicode/2.7
- version/aterm aterm/0.2.0
- version/rxvt-unicode rxvt-unicode/8.5a
- version/aterm aterm/1.00-beta2
- version/rxvt-unicode rxvt-unicode/5.2
- version/rxvt-unicode rxvt-unicode/6.1
- version/aterm aterm/0.4.2
- version/rxvt-unicode rxvt-unicode/8.6
- version/rxvt rxvt/2.6.3
- version/rxvt-unicode rxvt-unicode/4.9
- version/rxvt-unicode rxvt-unicode/1.7
- version/rxvt-unicode rxvt-unicode/2.9
- version/rxvt-unicode rxvt-unicode/7.4
- version/rxvt-unicode rxvt-unicode/9.0
- version/rxvt-unicode rxvt-unicode/7.9
- version/rxvt-unicode rxvt-unicode/7.6
- version/rxvt-unicode rxvt-unicode/8.2
- version/rxvt-unicode rxvt-unicode/5.7
- version/rxvt-unicode rxvt-unicode/4.6
- version/rxvt-unicode rxvt-unicode/3.5
- version/rxvt-unicode rxvt-unicode/8.0
- version/rxvt-unicode rxvt-unicode/3.0
- version/rxvt-unicode rxvt-unicode/1.4
- version/rxvt-unicode rxvt-unicode/1.9
- version/rxvt-unicode rxvt-unicode/1.2