The terminal_helper_execute function in terminal/terminal.c in Xfce Terminal 0.2.6 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a crafted link, as demonstrated using the "Open Link" functionality.

Lasse Karkkainen discovered that the Xfce Terminal did not correctly escape shell meta-characters during 'Open Link' actions. If a remote attacker tricked a user into opening a specially crafted URI, they could execute arbitrary commands with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Aug 14 2007 Kevin Fenzi <kevin at tummy.com> -     0.2.6-3

    - Add patch for CVE-2007-3770.

    - Update License tag

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that xfce-terminal, a terminal emulator for the xfce environment, did not correctly escape arguments passed to the processes spawned by 'Open Link'. This allowed malicious links to execute arbitrary commands upon the local system.

The remote host is affected by the vulnerability described in GLSA-200708-07 (Xfce Terminal: Remote arbitrary code execution)

    Lasse Karkkainen discovered that the function terminal_helper_execute()     in file terminal-helper.c does not properly escape the URIs before     processing.
  Impact :

    A remote attacker could entice a user to open a specially crafted link,     possibly leading to the remote execution of arbitrary code with the     privileges of the user running Xfce Terminal. Note that the exploit     code depends on the browser used to open the crafted link.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
28100	Ubuntu 6.06 LTS / 6.10 / 7.04 : xfce4-terminal vulnerability (USN-497-1)	Nessus	Ubuntu Local Security Checks	high
27725	Fedora 7 : Terminal-0.2.6-3.fc7 (2007-1620)	Nessus	Fedora Local Security Checks	high
27548	Debian DSA-1393-1 : xfce4-terminal - insecure execution	Nessus	Debian Local Security Checks	high
25872	GLSA-200708-07 : Xfce Terminal: Remote arbitrary code execution	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2007-3770

high

Tenable Plugins

high

high

high

high