BSD-derived telnetd options telrcv buffer overflow

telnetd-option-telrcv-bo (6875)

High Risk

Description:

Multiple BSD-derived telnet daemons are vulnerable to a buffer overflow in the telrcv function that processes Telnet options. The telrcv function fails to perform proper bounds checking for remote clients. By sending a specially-crafted option string to the telnet daemon, a remote attacker can overflow a buffer and execute arbitrary code on the system. An attacker can use this vulnerability to gain root privileges.

Platforms Affected:

• Cisco, Catalyst 2900
• Cisco, Catalyst 2948G
• Cisco, Catalyst 4000
• Cisco, Catalyst 5000
• Cisco, Catalyst 6000
• Conectiva, Linux
• Cray, UNICOS
• Debian, Debian Linux 2.2
• Debian, Debian Linux 3.0
• FreeBSD, FreeBSD 3.0
• FreeBSD, FreeBSD 3.1
• FreeBSD, FreeBSD 3.2
• FreeBSD, FreeBSD 3.3
• FreeBSD, FreeBSD 3.4
• FreeBSD, FreeBSD 3.5
• FreeBSD, FreeBSD 4.0
• FreeBSD, FreeBSD 4.1
• FreeBSD, FreeBSD 4.2
• FreeBSD, FreeBSD 4.3
• Gentoo, Linux
• IBM, AIX 4.3
• IBM, AIX 4.3.1
• IBM, AIX 4.3.2
• IBM, AIX 4.3.3
• IBM, AIX 5.1
• MandrakeSoft, Mandrake Linux 7.1
• MandrakeSoft, Mandrake Linux 7.2
• MandrakeSoft, Mandrake Linux 8.0
• MandrakeSoft, Mandrake Linux 8.1
• MandrakeSoft, Mandrake Linux Corporate Server 1.0.1
• MandrakeSoft, Mandrake Single Network Firewall 7.2
• MIT, Kerberos
• NetBSD, NetBSD 1.5
• RedHat, Linux 5.2
• RedHat, Linux 6.2
• RedHat, Linux 7
• RedHat, Linux 7.1
• RedHat, Linux 7.2
• RedHat, Linux 7.3
• SCO, Caldera OpenLinux
• SCO, Caldera OpenServer 5
• SGI, IRIX 6.5
• Sun, Solaris
• SuSE, SuSE Linux 6.1
• SuSE, SuSE Linux 6.2
• SuSE, SuSE Linux 6.3
• SuSE, SuSE Linux 6.4
• SuSE, SuSE Linux 7.0
• SuSE, SuSE Linux 7.1
• SuSE, SuSE Linux 7.2
• Various vendors, telnetd
• WindRiver, BSDOS 4.0
• WindRiver, BSDOS 4.0.1
• WindRiver, BSDOS 4.1
• WindRiver, BSDOS 4.2

Remedy:

For vulnerability detection:

Enable the following checks in the ISS Protection Platform:
TelnetdOptionTelrcvBo
telnetd-option-telrcv-bo

For Virtual Patch:

Enable the following checks in the ISS Protection Platform:
Telnet_Too_Many_AYTs

Block or restrict the following in the ISS Protection Platform as appropriate to the environment:
Port 23

For Manual Protection:

For FreeBSD 3.x, versions prior to 4.3, and 4.3-STABLE:
Upgrade to the latest version of FreeBSD (4.3-STABLE dated 2001-07-23 or later), as listed in FreeBSD Security Advisory FreeBSD-SA-01:49. See References.

— OR —

Apply the patch for this vulnerability, as listed in FreeBSD Security Advisory FreeBSD-SA-01:49. See References.

For Caldera OpenLinux 2.3, eServer 2.3.1, eBuilder, eDesktop 2.4, Server 3.1, and Workstation 3.1:
Upgrade to the latest version of netkit-telnet (0.17-12a or later), as listed in Caldera International, Inc. Security Advisory CSSA-2001-030.0. See References.

For Mandrake Linux 7.1 and Corporate Server 1.0.1:
Upgrade to the latest version of telnet (0.16-4 or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:068 : telnet. See References.

For Mandrake Linux 7.2, 8.0, and Single Network Firewall 7.2:
Upgrade to the latest version of telnet (0.17-7 or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:068 : telnet. See References.

For Mandrake Linux 8.1:
Upgrade to the latest version of krb5 (1.2.2-15.1mdk or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:093 : krb5. See References.

For Debian GNU/Linux 2.2 (potato):
Upgrade to the latest version of netkit-telnet (0.16-4potato.2 or later), as listed in DSA-070-1. See References.

For Debian GNU/Linux 2.2 (potato):
Upgrade to the latest version of netkit-telnet-ssl (0.16.3-1.1 or later), as listed in DSA-075-1. See References.

For Red Hat Linux 5.2 and 6.2:
Upgrade to the latest version of telnet (0.17.6x-18 or later), as listed in RHSA-2001:099-06. See References.

For Red Hat Linux 7.0 and 7.1
Upgrade to the latest version of telnet (0.17-18 or later), as listed in RHSA-2001:099-06. See References.

For MIT Kerberos 5:
Apply the telnetd_122_patch for your system, as listed in Kerberos Security Advisory 2001-07-31. See References.

For Red Hat Linux 6.2 using the Kerberos 5 package telnet server:
Upgrade to the latest version of krb5 (1.1.1-28 or later), as listed in RHSA-2001:100-02. See References.

For Red Hat Linux 7.0 and 7.1 using the Kerberos 5 package telnet server:
Upgrade to the latest version of krb5 (1.2.2-12 or later), as listed in RHSA-2001:100-02. See References.

For Conectiva Linux 4.0 and 4.0es:
Upgrade to the latest version of telnet (0.17-1U40 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.

For Conectiva Linux 4.1:
Upgrade to the latest version of telnet (0.17-1U41 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.

For Conectiva Linux 4.2:
Upgrade to the latest version of telnet (0.17-1U42 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.

For Conectiva Linux 5.0, ecommerce, and prg graficos:
Upgrade to the latest version of telnet (0.17-1U50 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.

For Conectiva Linux 5.1:
Upgrade to the latest version of telnet (0.17-1U51 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.

For Conectiva Linux 6.0:
Upgrade to the latest version of telnet (0.17-2U60 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.

For Conectiva Linux 7.0:
Upgrade to the latest version of telnet (0.17-2U70 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.

For SuSE Linux 7.0 (i386 Intel, Sparc, AXP Alpha, and PPC Power PC):
Upgrade to the latest version of nkitb or nkitserv (2001.8.16-0 or later), as listed in SuSE Security Announcement SuSE-SA:2001:029. See References.

For SuSE Linux 7.1 (i386 Intel, Sparc, AXP Alpha, and PPC Power PC):
Upgrade to the latest version of nkitb or nkitserv (2001.8.14-0 or later), as listed in SuSE Security Announcement SuSE-SA:2001:029. See References.

For SuSE Linux 7.2 (i386 Intel):
Upgrade to the latest version of telnet or telnet-server (1.0-69 or later), as listed in SuSE Security Announcement SuSE-SA:2001:029. See References.

For Cisco Catalyst 6000 series, Catalyst 5000 series, Catalyst 4000 series, Catalyst 2948G, and Catalyst 2900 switches:
Upgrade to the latest version of CatOS for your device, as listed in the Cisco Security Advisory dated January 29, 2002. See References.

For Cisco VPN 3000 Concentrators:
Upgrade to the latest software version for your device (3.6.1 or later), (3.5.5 or later), (3.1.2 or later for 3.1.x releases), or (3.0.3(B) or later for 3.0.x releases), as listed in Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities. See References.

For Gentoo Linux: Upgrade to the latest version of NetKit (0.17-r4 or later), as listed in GLSA 200410-03. See References.

For other distributions:
Contact your vendor for patch or upgrade information.

Consequences:

Gain Access

References:

• Apple Computer, Inc. Product Security Incident Response, Mac OS X v10.1 telnetd at http://www.apple.com/support/security/security_updates.html.
• BugTraq Mailing List, Thu Jul 26 2001 - 17:29:02 CDT, RE: Vulnerability in Windows 2000 TELNET service at http://archives.neohapsis.com/archives/bugtraq/2001-07/0644.html.
• BugTraq Mailing List, Tue Jul 24 2001 - 16:51:24 CDT, Re: multiple vendor telnet daemon vulnerability at http://archives.neohapsis.com/archives/bugtraq/2001-07/0559.html.
• BugTraq Mailing List, Tue Jul 24 2001 - 18:11:36 CDT, Re: multiple vendor telnet daemon vulnerability at http://archives.neohapsis.com/archives/bugtraq/2001-07/0562.html.
• BugTraq Mailing List, Wed Jul 18 2001 - 15:15:10 CDT, multiple vendor telnet daemon vulnerability at http://archives.neohapsis.com/archives/bugtraq/2001-07/0351.html.
• BugTraq Mailing List, Wed Jul 25 2001 - 02:44:46 CDT, SCO - Telnetd AYT overflow ? at http://archives.neohapsis.com/archives/bugtraq/2001-07/0599.html.
• BugTraq Mailing List, Wed Jul 25 2001 - 17:51:28 CDT, Vulnerability in Windows 2000 TELNET service at http://archives.neohapsis.com/archives/bugtraq/2001-07/0611.html.
• Caldera International, Inc. Security Advisory CSSA-2001-030.0, Linux - Telnet AYT remote exploit at ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2001-030.0.txt.
• Caldera International, Inc. Security Advisory CSSA-2001-SCO.10, telnetd buffer overflow at ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.10/CSSA-2001-SCO.10.txt.
• CERT Advisory CA-2001-21, Buffer Overflow in telnetd at http://www.cert.org/advisories/CA-2001-21.html.
• CIAC Information Bulletin L-124, Remote Buffer Overflow in telnetd at http://www.ciac.org/ciac/bulletins/l-124.shtml.
• CIAC Information Bulletin L-128, MIT Kerberos 5 telnetd Buffer Overflows at http://www.ciac.org/ciac/bulletins/l-128.shtml.
• CIAC Information Bulletin L-131, IBM AIX telnetd Buffer Overflow at http://www.ciac.org/ciac/bulletins/l-131.shtml.
• CIAC Information Bulletin M-006, HP-UX telnetd Security Vulnerability at http://www.ciac.org/ciac/bulletins/m-006.shtml.
• CIAC Information Bulletin M-043, Hewlett-Packard Buffer Overflow in Telnet Server Vulnerability at http://www.ciac.org/ciac/bulletins/m-043.shtml.
• CIAC Information Bulletin M-119, Cisco VPN Concentrators and VPN 3002 Client Multiple Vulnerabilities at http://www.ciac.org/ciac/bulletins/m-119.shtml.
• Cisco Systems Inc. Security Advisory, 2002 January 29 1500 UTC, Cisco CatOS Telnet Buffer Vulnerability at http://www.cisco.com/warp/public/707/catos-telrcv-vuln-pub.shtml.
• Compaq Services Software Patches SSRT0745U, potential telnetd option handling vulnerability at http://ftp.support.compaq.com/patches/.new/html/SSRT0745U.shtml.
• Conectiva Linux Announcement CLSA-2001:413, telnet at http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000413.
• Cray Service Bulletin, September/October 2001, Volume 3, Number 5, Security Issues Reported, CERT Advisory CA-2001-21 at http://www.kfa-juelich.de/zam/docs/CRSB/crsb_01_05.pdf.
• FedCIRC Advisory FA-2001-21, Buffer Overflow in telnetd at http://www2.fedcirc.gov/advisories/FA-2001-21.html.
• FreeBSD Security Advisory FreeBSD-SA-01:49, telnetd contains remote buffer overflow at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:49.telnetd.asc.
• Hewlett-Packard Company Security Bulletin HPSBUX0110-172, Sec. Vulnerability in telnetd at http://online.securityfocus.com/advisories/3610. (From SecurityFocus archive.)
• IBM Managed Security Services Outside Advisory Redistribution MSS-OAR-E01-2001:298.1, Buffer overflow vulnerability in telnet daemon at http://archives.neohapsis.com/archives/bugtraq/2001-07/0776.html.
• Kerberos Security Advisory 2001-07-31, KRB5 TELNETD BUFFER OVERFLOWS at http://web.mit.edu/kerberos/www/advisories/telnetd.txt.
• SGI Security Advisory 20010801-01-P, IRIX Telnet protocol options at ftp://patches.sgi.com/support/free/security/advisories/20010801-01-P.
• SuSE Security Announcement SuSE-SA:2001:029, nkitb/nkitserv/telnetd at http://www.suse.de/de/security/2001_029_nkitb_txt.txt.
• vpn3k-multiple-vuln-pub, Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities at http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml.
• BID-3064: Multiple Vendor Telnetd Buffer Overflow Vulnerability
• CVE-2001-0554: Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
• DSA-070: netkit-telnet -- remote exploit
• DSA-075: netkit-telnet-ssl -- remote exploit
• GLSA-200410-03: NetKit-telnetd: buffer overflows in telnet and telnetd
• MDKSA-2001:068: Updated telnet packages fix buffer overflow vulnerability
• OSVDB ID: 809: Multiple BSD Telnet Option Handling Overflow
• RHSA-2001-099: New telnet packages available to fix buffer overflow vulnerabilities
• RHSA-2001-100: Updated Kerberos 5 packages now available
• US-CERT VU#745371: Multiple vendor telnet daemons vulnerable to buffer overflow via crafted protocol options

Reported:

Jul 18, 2001

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page