A 10-year old root exploit was found in the Unix “man” program used for displaying system documentation.

The “man trap exploit” is triggered when certain key combinations and escape sequences are triggered in malicious man pages, which would be able to use the screen buffer memory to replay login details. Infected man pages have been found in the core utilities of virtually every Linux and BSD distribution.

“This is shocking”, said security expert Justin Case. “Not only in that it works, but that it has gone undetected for so long.”

Security patches were responsibly disclosed to distribution maintainers 3 months before the time of writing. System administrators are recommended to update to the latest patch in line with good security practices.

“Our main consolation is that the exploit requires you to actually read a man page from start to finish. As that has never in the history of computing actually happened, we’re pretty sure there were no victims.”