4 ms·
Read carefully. >I was searching for a bug in ANSI characters that respond to a change of the window’s title. One of the things I did was check how the previou
by Arnavion 3y ago
Read carefully.
>I was searching for a bug in ANSI characters that respond to a change of the window’s title. One of the things I did was check how the previous bugs were exploited. One of them, CVE-2015-8971 (found by Nicolas Braud-Santoni), was a bug in Terminology 0.7.0 that didn’t filter new line (\n) escape character when changing the window title. It allowed you to modify the window title and then re-insert it into the terminal’s input buffer, resulting in arbitrary terminal input, which then caused code execution.
- gunapologist99 3y agoThat's a vulnerability in your terminal app, not in SSH, like a browser vuln when connecting to a remote website, but you're right, the point is well taken: there is always that possibility and you should be quite careful about choosing your terminal application.