A vulnerability has been identified in rxvt-unicode, which could be exploited by local attackers to bypass security policies. This flaw is due to an error where permissions are not correctly updated on the tty device (world-readable and world-writable), which could be exploited by attackers to gain read/write access to the devices.

Affected Products

rxvt-unicode versions prior to 6.3

Solution

Upgrade to rxvt-unicode version 6.3 :
http://dist.schmorp.de/rxvt-unicode/

References

http://www.vupen.com/english/advisories/2006/0052
http://dist.schmorp.de/rxvt-unicode/Changes

Credits

Vulnerability reported by Ryan Beasley

Changelog

2006-01-05 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.