Long username used for Telnet authentication
| telnet-auth-user-long (3948) |  Low Risk |
Description:
An attempt to send a very long authentication username using a Telnet client has been detected. A long username often indicates an attempt to probe telnet daemons for possible buffer overflows, and it should be considered very suspicious.
Consequences:
Gain Access
Remedy:
Examine other events that involve the target IP address. Examine the reported event for suspicious words or phrases. Audit the security of all involved systems. Time and resource permitting, view the associated session to determine if this event indicates an attack.
References:
- BugTraq Mailing List, Mon Dec 06 1999 - 00:18:18 CST: Remote DoS Attack in GoodTech Telnet Server NT v2.2.1 Vulnerability.
- BugTraq Mailing List, Thu, 4 Nov 1999 05:10:32 -0300: Remote DoS Attack in BFTelnet Server v1.1 for Windows NT.
- NTBugTraq Mailing List, Mon, 17 Jul 2000 01:05:15 -800: DoS in Gamsoft TelSrv telnet server for MS Windows 95/98/NT/2k..
- Underground Security Systems Research advisory USSR-2000033: Local / Remote Exploiteable Buffer Overflow Vulnerability in InterAccess TelnetD Server 4.0 for Windows NT.
- Underground Security Systems Research advisory USSR-2000046: Multiples Remotes DoS Attacks in Dragon Server v1.00 and v2.00 Vulnerability.
- BID-1352: Shadow Op Dragon Server Multiple DoS Vulnerabilities
- BID-1478: GAMSoft Telsrv DoS Vulnerability
- BID-771: Byte Fusion BFTelnet Long Username DoS Vulnerability
- BID-862: GoodTech Telnet Server NT DoS Vulnerability
- BID-995: InterAccess TelnetD Server 4.0 Buffer Overflow Vulnerability
- CVE-1999-0904: Buffer overflow in BFTelnet allows remote attackers to cause a denial of service via a long username.
- CVE-1999-0991: Buffer overflow in GoodTech Telnet Server NT allows remote users to cause a denial of service via a long login name.
- CVE-2000-0166: Buffer overflow in the InterAccess telnet server TelnetD allows remote attackers to execute commands via a long login name.
- CVE-2000-0480: Dragon telnet server allows remote attackers to cause a denial of service via a long username.
- CVE-2000-0665: GAMSoft TelSrv telnet server 1.5 and earlier allows remote attackers to cause a denial of service via a long username.
- OSVDB ID: 373: GAMSoft TelSrv Username Overflow DoS
Platforms Affected:
- Byte Fusion Corporation BFTelnet Server 1.1
- Gamsoft GAMSoft Telsrv 1.4
- Gamsoft GAMSoft Telsrv 1.5
- GoodTech Systems GoodTech Telnet Server NT 2.2.1
- Pragma Systems Pragma InterAccess 4.0b5 and prior
- Shadow Op Software Dragon Server 1.0
- Shadow Op Software Dragon Server 2.0
Reported:
Jul 24, 1999
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net