Re: possible gnome-terminal/vte DoS?

On Tue, Sep 17, 2002 at 08:57:38PM -0400, Havoc Pennington wrote:
> It's not a DoS, right, unless this can happen as the result of a
> hostile attacker's actions.
> 
> It is certainly a bug.

Maybe I should have been more explicit -- it can happen as the result of
a hostile attacker's actions.

Imagine an attacker with physical access to the keyboard and mouse but
not to the computer itself (the computer itself is physically secured).
The computer allows one person (at a time) to use it in person and also
allows other users to use it remotely via SSH.

Assume that Alice and Bob are connected to this system remotely and that
Charlie is using it in person. Charlie knows that Alice and Bob are
logged in (maybe he ran the "who" command, maybe he just finished a cell
phone conversation with one of them). Charlie, for some reason, wants to
annoy Alice and Bob. (Or, even if no remote access is possible, maybe he
just wants to take one computer out of commission temporarily and annoy
everyone else in the lab.) So he takes his open gnome-terminal, sets the
font size to 12000 and ka-boom.

I would expect that there are other scenarios where this could be used
as an attack...

-Barry K. Nathan <[email protected]>