Detections
Analytics

Debian DSA-1393-1 : xfce4-terminal - insecure execution

high Nessus Plugin ID 27548

Synopsis

The remote Debian host is missing a security-related update.

Description

It was discovered that xfce-terminal, a terminal emulator for the xfce environment, did not correctly escape arguments passed to the processes spawned by 'Open Link'. This allowed malicious links to execute arbitrary commands upon the local system.

Solution

Upgrade the xfce4-terminal package.

For the stable distribution (etch), this problem has been fixed in version 0.2.5.6rc1-2etch1.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=437454

https://www.debian.org/security/2007/dsa-1393

Plugin Details

Severity: High

ID: 27548

File Name: debian_DSA-1393.nasl

Version: 1.16

Type: local

Agent: unix

Published: 10/25/2007

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: High

Base Score: 7.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:P/A:N

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:4.0, p-cpe:/a:debian:debian_linux:xfce4-terminal

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 10/23/2007

Reference Information

CVE: CVE-2007-3770

DSA: 1393