rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 3.7 | LOW | AV:L/AC:H/Au:N/C:P/I:P/A:P |
Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-1142 This issue does not affect Red Hat Enterprise Linux 3, 4, or 5. The Red Hat Security Response Team has rated this issue as having low security impact. Due to the minimal security consequences of this issue, we do not intend to fix this in Red Hat Enterprise Linux 2.1. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/
| Hyperlink | Source | Resource |
|---|---|---|
| http://article.gmane.org/gmane.comp.security.oss.general/122 | cve@mitre.org | N/A |
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296 | cve@mitre.org | Vendor Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html | cve@mitre.org | N/A |
| http://secunia.com/advisories/29576 | cve@mitre.org | Vendor Advisory |
| http://secunia.com/advisories/30224 | cve@mitre.org | Vendor Advisory |
| http://secunia.com/advisories/30225 | cve@mitre.org | Vendor Advisory |
| http://secunia.com/advisories/30226 | cve@mitre.org | Vendor Advisory |
| http://secunia.com/advisories/30227 | cve@mitre.org | Vendor Advisory |
| http://secunia.com/advisories/30229 | cve@mitre.org | Vendor Advisory |
| http://secunia.com/advisories/31687 | cve@mitre.org | Vendor Advisory |
| http://security.gentoo.org/glsa/glsa-200805-03.xml | cve@mitre.org | N/A |
| http://www.mandriva.com/security/advisories?name=MDVSA-2008:161 | cve@mitre.org | N/A |
| http://www.mandriva.com/security/advisories?name=MDVSA-2008:221 | cve@mitre.org | N/A |
| http://www.securityfocus.com/bid/28512 | cve@mitre.org | Patch |