{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "dtterm.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "hanterm-xf 2.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Konsole 3.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "SecureCRT 3.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Eterm 0.9.x (Eterm 0.9.2 n\u0027est pas vuln\u00e9rable) ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "putty 0.5x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "aterm 0.4.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "rxvt 2.7.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "gnome-terminal 2.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne s\u00e9quence d\u0027\u00e9chappement est constitu\u00e9 d\u0027une s\u00e9rie de caract\u00e8res\nd\u00e9butant par un caract\u00e8re d\u0027\u00e9chappement (`0x1B`) suivi d\u0027une s\u00e9quence de\ncaract\u00e8res ordinaires.\n\nUne mauvaise gestion des s\u00e9quences d\u0027\u00e9chappement dans plusieurs\n\u00e9mulateurs de terminaux permet \u00e0 un individu mal intentionn\u00e9 de tromper\nla vigilance d\u0027un utilisateur afin d\u0027ex\u00e9cuter des commandes arbitraires\nou de modifier certains fichiers.\n\n## Solution\n\nAppliquer les correctifs suivants les terminaux utilis\u00e9s :  \n\nVuln\u00e9rabilit\u00e9 dans l\u0027\u00e9mulateur de terminaux `rxvt` :\n\n-   Bulletin de s\u00e9curit\u00e9 Mandrake :\n\n        http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:034\n\n-   Bulletin de s\u00e9curit\u00e9 RedHat :\n\n        http://rhn.redhat.com/errata/RHSA-2003-054.html\n\n-   Bulletin de s\u00e9curit\u00e9 Gentoo :\n\n        http://forums.gentoo.org/viewtopic.php?t=42582\n\nVuln\u00e9rabilit\u00e9 dans l\u0027\u00e9mulateur de terminaux `gnome-terminal` :\n\n-   Bulletin de s\u00e9curit\u00e9 RedHat :\n\n        http://rhn.redhat.com/errata/RHSA-2003-053.html\n\nVuln\u00e9rabilit\u00e9 dans l\u0027\u00e9mulateur de terminaux `Eterm` :\n\n-   Bulletin de s\u00e9curit\u00e9 Gentoo :\n\n        http://www.securityfocus.com/advisories/5034\n\n-   Bulletin de s\u00e9curit\u00e9 Debian DSA-496 :\n\n        http://www.debian.org/security/2004/dsa-496\n\nVuln\u00e9rabilit\u00e9 dans l\u0027\u00e9mulateur de terminaux `dtterm` :\n\n-   Bulletin de s\u00e9curit\u00e9 HPSBUX0401-309 \"SSRT3507 dtterm\" de\n    Hewlett-Packard :\n\n        http://itrc.hp.com\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin Digital Defense Incoporated :",
      "url": "http://digitaldefense.net/labs/papers/Termulation.txt"
    }
  ],
  "reference": "CERTA-2003-AVI-067",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2003-03-28T00:00:00.000000"
    },
    {
      "description": "Ajout r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 HPSBUX0401-309 de Hewlett-Packard.",
      "revision_date": "2004-01-23T00:00:00.000000"
    },
    {
      "description": "Ajout r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Debian.",
      "revision_date": "2004-04-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de commandes arbitraires"
    },
    {
      "description": "Injection de donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans plusieurs \u00e9mulateurs de\nterminaux permettant \u00e0 un individu mal intentionn\u00e9 de d\u00e9tourner des\nactions effectu\u00e9es par l\u0027utilisateur du terminal.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les \u00e9mulateurs de terminaux",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de Digital Defense Incorporated",
      "url": null
    }
  ]
}