Critical Remote Code Execution Flaw Fixed In Popular Terminal App For MacOS

'iTerm2 users: It's time to upgrade. A security audit sponsored by the
Mozilla Open Source Support Program uncovered a critical remote code
execution (RCE) vulnerability in the popular open-source terminal app
for macOS. ITerm2 is an open-source alternative to the built-in macOS
Terminal app, which allows users to interact with the command-line
shell. Terminal apps are commonly used by system administrators,
developers and IT staff in general, including security teams, for a
variety of tasks and day-to-day operations.

The iTerm2 app is a popular choice on macOS because it has features
and allows customizations that the built-in Terminal doesn't, which is
why the Mozilla Open Source Support Program (MOSS) decided to sponsor
a code audit for it. The MOSS was created in the wake of the critical
and wide-impact Heartbleed vulnerability in OpenSSL with the goal of
sponsoring security audits for widely used open-source technologies.
The flaw, which is now tracked as CVE-2019-9535, has existed in iTerm2
for the past seven years and is located in the tmux integration. Tmux
is a terminal multiplexer that allows running multiple sessions in the
same terminal window by splitting the terminal screen. The flaw was
fixed in iTerm2 version 3.3.6, which was released today.'

-- source: https://apple.slashdot.org/story/19/10/09/2048214

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz