CVE-2008-2383: Code Injection

Published Jan 2, 2009

Updated

CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.

Affected Software

1 affected component

invisible-island xterm=_nil_

Event History

Jan 2, 2009

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2383?

CVE-2008-2383 is classified as a high severity vulnerability due to the potential for command execution.

How do I fix CVE-2008-2383?

To fix CVE-2008-2383, ensure that you are using an updated version of xterm that has patched this vulnerability.

Who is affected by CVE-2008-2383?

CVE-2008-2383 affects users of the xterm terminal emulator from Invisible Island.

What is the impact of CVE-2008-2383?

The impact of CVE-2008-2383 is that it allows user-assisted attackers to execute arbitrary commands.

Can CVE-2008-2383 be exploited remotely?

CVE-2008-2383 requires user interaction for exploitation, making it not remotely exploitable.