Your message dated Fri, 11 Sep 2009 13:49:36 +0200
with message-id <1252669776.15445.3.ca...@shizuru>
and subject line Re: Bug#546018: gnome-terminal: Pressing keyboard keys alters
cursor blinking
has caused the Debian Bug report #546018,
regarding gnome-terminal: Pressing keyboard keys alters cursor blinking
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
546018: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546018
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gnome-terminal
Version: 2.22.3-3
Severity: grave
Tags: security
Justification: user security hole
After any key is pressed (even Alt, Ctrl or Caps), gnome-terminal resets its
blinking cursor's "next color-switch time" to "now + one full color-switching
period". This (partially) defeats the purpose of not printing any character
when reading a password, and allows an attacker to acquire some information
on theoretically secret data (through a timing attack).
I believe su and ssh are the main impacted applications.
At least, I recommend disabling this feature when character echoing is off.
-- System Information:
Debian Release: 5.0.3
APT prefers stable
APT policy: (500, 'stable')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-2-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash
Versions of packages gnome-terminal depends on:
ii gnome-terminal-data 2.22.3-3 Data files for the GNOME terminal
ii libatk1.0-0 1.22.0-1 The ATK accessibility toolkit
ii libbonobo2-0 2.22.0-1 Bonobo CORBA interfaces library
ii libc6 2.7-18 GNU C Library: Shared libraries
ii libgconf2-4 2.22.0-1 GNOME configuration database syste
ii libglade2-0 1:2.6.2-1 library to load .glade files at ru
ii libglib2.0-0 2.16.6-2 The GLib library of C routines
ii libgnome2-0 2.20.1.1-1 The GNOME 2 library - runtime file
ii libgnomeui-0 2.20.1.1-2 The GNOME 2 libraries (User Interf
ii libgtk2.0-0 2.12.12-1~lenny1 The GTK+ graphical user interface
ii liborbit2 1:2.14.13-0.1 libraries for ORBit2 - a CORBA ORB
ii libpango1.0-0 1.20.5-5 Layout and rendering of internatio
ii libstartup-notification 0.9-1 library for program launch feedbac
ii libvte9 1:0.16.14-4 Terminal emulator widget for GTK+
ii libx11-6 2:1.1.5-2 X11 client-side library
ii libxrender1 1:0.9.4-2 X Rendering Extension client libra
ii scrollkeeper 0.3.14-16 A free electronic cataloging syste
Versions of packages gnome-terminal recommends:
ii yelp 2.22.1-8+b1 Help browser for GNOME 2
gnome-terminal suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Le jeudi 10 septembre 2009 à 21:16 +0200, Emmanuel Colbus a écrit :
> After any key is pressed (even Alt, Ctrl or Caps), gnome-terminal resets its
> blinking cursor's "next color-switch time" to "now + one full color-switching
> period". This (partially) defeats the purpose of not printing any character
> when reading a password, and allows an attacker to acquire some information
> on theoretically secret data (through a timing attack).
>
> I believe su and ssh are the main impacted applications.
>
> At least, I recommend disabling this feature when character echoing is off.
Seriously, what security hole are you talking about? If you are not
typing fast enough for this to be a potential way for someone who is
looking at you to obtain your password, that someone can obtain it as
well by looking at your fingers.
This feature is way too useful to be deactivated without solid ground.
Cheers,
--
.''`. Josselin Mouette
: :' :
`. `' “I recommend you to learn English in hope that you in
`- future understand things” -- Jörg Schilling
signature.asc
Description: Ceci est une partie de message numériquement signée
--- End Message ---
