Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2000-0476

CWE-400 — Uncontrolled Resource Consumption7 documents6 sources
Severity
5.0MEDIUM
EPSS
9.5%
top 7.17%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Michael Jennings EtermPutty PuttyRxvt Rxvt+1 more
Timeline
PublishedJun 1
Latest updateJun 11

Description

xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶NVDrxvt/rxvt2.6.1
▶NVDputty/putty0.48
▶NVDxfree86_project/x11r63.3.3, 4.0+1

Patches

Patch: archives.neohapsis.com ↗Patch: www.securityfocus.com ↗Patch: archives.neohapsis.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-v649-2qq3-7mg9: xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized↗2022-04-30
▶
CVEList
CVE-2000-0476: xterm, Eterm, and rxvt allow an attacker to cause a denial of service by embedding certain escape characters which force the window to be resized↗2000-07-12
▶

💥Exploits & PoCs

2
Exploit-DB
Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2)↗2007-03-07
▶
Exploit-DB
Eterm 0.8.10 / rxvt 2.6.1 / PuTTY 0.48 / X11R6 3.3.3/4.0 - Denial of Service↗2000-05-31
▶

📋Vendor Advisories

2
Microsoft
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence a related issue to CVE-2000-0476.↗2024-06-11
▶
Red Hat
vte: Denial of service via window resize escape sequence↗2024-06-09
▶