Rapid window title changes cause ‘white screen of death’

guest · Jan 8, 2022

January 8, 2022

Experimentation with ANSI escape characters on terminal emulators has led to the discovery of multiple high-severity DoS (denial of service) vulnerabilities on Windows terminals and Chrome-based web browsers.

Eviatar Gerzi, a security researcher at CyberArk, has tried out various potential abuse pathways based on an old 2003 advisory on code execution via window title modifications and discovered a way to induce rapid window title changes on PuTTY.
This atypical attack caused the test machine to enter a state known as the “White Screen of Death”, where everything freezes except for the mouse cursor.
Click to expand...

The abused function is 'SetWindowText,' which allows changing the text of the specified window’s title bar.

The only way out of the WSOD state is to restart the computer, so this simple trick can lead to a DoS state on a range of applications.
As the researcher points out, 'SetWindowText' isn’t the only possible leverage for hung ups, as discovered in the case of MobaXterm.
Click to expand...

Trying it out on web browsers
Realizing that almost all GUI applications use the SetWindowText function, the researcher tried out the attack against popular web browsers such as Chrome.
In all cases though, the underlying OS remains unaffected because modern browsers are based on sandboxes.

However, when trying the browser attack inside a virtual machine, a resource depletion issue occurred causing the virtualized system to display a 'Blue Screen of Death.'
Gerzi contacted the affected vendors and received the following responses: [...]
Click to expand...

CyberArk: Don’t Trust This Title: Abusing Terminal Emulators with ANSI Escape Characters

In this blog post, I am going to show you how research on terminal emulators took a different turn when I found a remote denial of service (DoS) vulnerability by abusing a Windows system call indirectly. We will show how this issue further affects other components, which may surprise you. This research led us to a total of nine vulnerabilities in different terminals. Buckle up; we are starting now.
Click to expand...

TL;DR
This research led to:

Five high severity vulnerabilities: CVE-2021-28847, CVE-2021-28848, CVE-2021-32198, CVE-2021-33500 and CVE-2021-42095. We found a way to cause a remote DoS on the terminal client’s host.

An ANSI escape characters injection vulnerability in OpenShift and Kubernetes (CVE-2021-25743).

Three additional vulnerabilities: CVE-2021-31701, CVE-2021-37326 and CVE-2021-40147. We found a way to bypass the bracket paste mode mechanism inside the terminals.

Click to expand...

Log in or Sign up

Rapid window title changes cause ‘white screen of death’

guest Guest

Log in or Sign up

Rapid window title changes cause ‘white screen of death’

guest Guest

Useful Searches