BSD-derived telnetd options telrcv buffer overflow
| telnetd-option-telrcv-bo (6875) |  High Risk |
Description:
Multiple BSD-derived telnet daemons are vulnerable to a buffer overflow in the telrcv function that processes Telnet options. The telrcv function fails to perform proper bounds checking for remote clients. By sending a specially-crafted option string to the telnet daemon, a remote attacker can overflow a buffer and execute arbitrary code on the system. An attacker can use this vulnerability to gain root privileges.
Consequences:
Gain Access
Remedy:
For vulnerability detection:
Enable the following checks in the ISS Protection Platform:
TelnetdOptionTelrcvBo
telnetd-option-telrcv-bo
Enable the following checks in the ISS Protection Platform:
Telnet_Too_Many_AYTs
Block or restrict the following in the ISS Protection Platform as appropriate to the environment:
Port 23
For Manual Protection:
For FreeBSD 3.x, versions prior to 4.3, and 4.3-STABLE:
Upgrade to the latest version of FreeBSD (4.3-STABLE dated 2001-07-23 or later), as listed in FreeBSD Security Advisory FreeBSD-SA-01:49. See References.
— OR —
Apply the patch for this vulnerability, as listed in FreeBSD Security Advisory FreeBSD-SA-01:49. See References.
For Caldera OpenLinux 2.3, eServer 2.3.1, eBuilder, eDesktop 2.4, Server 3.1, and Workstation 3.1:
Upgrade to the latest version of netkit-telnet (0.17-12a or later), as listed in Caldera International, Inc. Security Advisory CSSA-2001-030.0. See References.
For Mandrake Linux 7.1 and Corporate Server 1.0.1:
Upgrade to the latest version of telnet (0.16-4 or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:068 : telnet. See References.
For Mandrake Linux 7.2, 8.0, and Single Network Firewall 7.2:
Upgrade to the latest version of telnet (0.17-7 or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:068 : telnet. See References.
For Mandrake Linux 8.1:
Upgrade to the latest version of krb5 (1.2.2-15.1mdk or later), as listed in MandrakeSoft Security Advisory MDKSA-2001:093 : krb5. See References.
For Debian GNU/Linux 2.2 (potato):
Upgrade to the latest version of netkit-telnet (0.16-4potato.2 or later), as listed in DSA-070-1. See References.
For Debian GNU/Linux 2.2 (potato):
Upgrade to the latest version of netkit-telnet-ssl (0.16.3-1.1 or later), as listed in DSA-075-1. See References.
For Red Hat Linux 5.2 and 6.2:
Upgrade to the latest version of telnet (0.17.6x-18 or later), as listed in RHSA-2001:099-06. See References.
For Red Hat Linux 7.0 and 7.1
Upgrade to the latest version of telnet (0.17-18 or later), as listed in RHSA-2001:099-06. See References.
For MIT Kerberos 5:
Apply the telnetd_122_patch for your system, as listed in Kerberos Security Advisory 2001-07-31. See References.
For Red Hat Linux 6.2 using the Kerberos 5 package telnet server:
Upgrade to the latest version of krb5 (1.1.1-28 or later), as listed in RHSA-2001:100-02. See References.
For Red Hat Linux 7.0 and 7.1 using the Kerberos 5 package telnet server:
Upgrade to the latest version of krb5 (1.2.2-12 or later), as listed in RHSA-2001:100-02. See References.
For Conectiva Linux 4.0 and 4.0es:
Upgrade to the latest version of telnet (0.17-1U40 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.
For Conectiva Linux 4.1:
Upgrade to the latest version of telnet (0.17-1U41 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.
For Conectiva Linux 4.2:
Upgrade to the latest version of telnet (0.17-1U42 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.
For Conectiva Linux 5.0, ecommerce, and prg graficos:
Upgrade to the latest version of telnet (0.17-1U50 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.
For Conectiva Linux 5.1:
Upgrade to the latest version of telnet (0.17-1U51 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.
For Conectiva Linux 6.0:
Upgrade to the latest version of telnet (0.17-2U60 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.
For Conectiva Linux 7.0:
Upgrade to the latest version of telnet (0.17-2U70 or later), as listed in Conectiva Linux Security Announcement CLA-2001:413. See References.
For SuSE Linux 7.0 (i386 Intel, Sparc, AXP Alpha, and PPC Power PC):
Upgrade to the latest version of nkitb or nkitserv (2001.8.16-0 or later), as listed in SuSE Security Announcement SuSE-SA:2001:029. See References.
For SuSE Linux 7.1 (i386 Intel, Sparc, AXP Alpha, and PPC Power PC):
Upgrade to the latest version of nkitb or nkitserv (2001.8.14-0 or later), as listed in SuSE Security Announcement SuSE-SA:2001:029. See References.
For SuSE Linux 7.2 (i386 Intel):
Upgrade to the latest version of telnet or telnet-server (1.0-69 or later), as listed in SuSE Security Announcement SuSE-SA:2001:029. See References.
For Cisco Catalyst 6000 series, Catalyst 5000 series, Catalyst 4000 series, Catalyst 2948G, and
Catalyst 2900 switches:
Upgrade to the latest version of CatOS for your device, as listed in the Cisco Security Advisory dated January 29, 2002. See References.
For Cisco VPN 3000 Concentrators:
Upgrade to the latest software version for your device (3.6.1 or later), (3.5.5 or later), (3.1.2 or later for 3.1.x releases), or (3.0.3(B) or later for 3.0.x releases), as listed in Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities. See References.
For Gentoo Linux: Upgrade to the latest version of NetKit (0.17-r4 or later), as listed in GLSA 200410-03. See References.
For other distributions:
Contact your vendor for patch or upgrade information.
References:
- Apple Computer, Inc. Product Security Incident Response: Mac OS X v10.1 telnetd.
- BugTraq Mailing List, Thu Jul 26 2001 - 17:29:02 CDT: RE: Vulnerability in Windows 2000 TELNET service.
- BugTraq Mailing List, Tue Jul 24 2001 - 16:51:24 CDT: Re: multiple vendor telnet daemon vulnerability.
- BugTraq Mailing List, Tue Jul 24 2001 - 18:11:36 CDT: Re: multiple vendor telnet daemon vulnerability.
- BugTraq Mailing List, Wed Jul 18 2001 - 15:15:10 CDT: multiple vendor telnet daemon vulnerability.
- BugTraq Mailing List, Wed Jul 25 2001 - 02:44:46 CDT: SCO - Telnetd AYT overflow ?.
- BugTraq Mailing List, Wed Jul 25 2001 - 17:51:28 CDT: Vulnerability in Windows 2000 TELNET service.
- Caldera International, Inc. Security Advisory CSSA-2001-030.0: Linux - Telnet AYT remote exploit.
- Caldera International, Inc. Security Advisory CSSA-2001-SCO.10: telnetd buffer overflow.
- CERT Advisory CA-2001-21: Buffer Overflow in telnetd.
- CIAC Information Bulletin L-124: Remote Buffer Overflow in telnetd.
- CIAC Information Bulletin L-128: MIT Kerberos 5 telnetd Buffer Overflows.
- CIAC Information Bulletin L-131: IBM AIX telnetd Buffer Overflow.
- CIAC Information Bulletin M-006: HP-UX telnetd Security Vulnerability.
- CIAC Information Bulletin M-043: Hewlett-Packard Buffer Overflow in Telnet Server Vulnerability.
- CIAC Information Bulletin M-119: Cisco VPN Concentrators and VPN 3002 Client Multiple Vulnerabilities.
- Cisco Systems Inc. Security Advisory, 2002 January 29 1500 UTC: Cisco CatOS Telnet Buffer Vulnerability.
- Compaq Services Software Patches SSRT0745U: potential telnetd option handling vulnerability.
- Conectiva Linux Announcement CLSA-2001:413: telnet.
- Cray Service Bulletin, September/October 2001, Volume 3, Number 5: Security Issues Reported, CERT Advisory CA-2001-21.
- FedCIRC Advisory FA-2001-21: Buffer Overflow in telnetd.
- FreeBSD Security Advisory FreeBSD-SA-01:49: telnetd contains remote buffer overflow.
- Hewlett-Packard Company Security Bulletin HPSBUX0110-172: Sec. Vulnerability in telnetd. (From SecurityFocus archive.)
- IBM Managed Security Services Outside Advisory Redistribution MSS-OAR-E01-2001:298.1: Buffer overflow vulnerability in telnet daemon.
- Kerberos Security Advisory 2001-07-31: KRB5 TELNETD BUFFER OVERFLOWS.
- SGI Security Advisory 20010801-01-P: IRIX Telnet protocol options.
- SuSE Security Announcement SuSE-SA:2001:029: nkitb/nkitserv/telnetd.
- vpn3k-multiple-vuln-pub: Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities.
- BID-3064: Multiple Vendor Telnetd Buffer Overflow Vulnerability
- CVE-2001-0554: Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
- DSA-070: netkit-telnet -- remote exploit
- DSA-075: netkit-telnet-ssl -- remote exploit
- GLSA-200410-03: NetKit-telnetd: buffer overflows in telnet and telnetd
- MDKSA-2001:068: Updated telnet packages fix buffer overflow vulnerability
- OSVDB ID: 809: Multiple BSD Telnet Option Handling Overflow
- RHSA-2001-099: New telnet packages available to fix buffer overflow vulnerabilities
- RHSA-2001-100: Updated Kerberos 5 packages now available
- US-CERT VU#745371: Multiple vendor telnet daemons vulnerable to buffer overflow via crafted protocol options
Platforms Affected:
- Cisco Catalyst 2900
- Cisco Catalyst 2948G
- Cisco Catalyst 4000
- Cisco Catalyst 5000
- Cisco Catalyst 6000
- Connectiva Linux
- Cray UNICOS
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- FreeBSD FreeBSD 3.0
- FreeBSD FreeBSD 3.1
- FreeBSD FreeBSD 3.2
- FreeBSD FreeBSD 3.3
- FreeBSD FreeBSD 3.4
- FreeBSD FreeBSD 3.5
- FreeBSD FreeBSD 4.0
- FreeBSD FreeBSD 4.1
- FreeBSD FreeBSD 4.2
- FreeBSD FreeBSD 4.3
- Gentoo Linux
- IBM AIX 4.3
- IBM AIX 4.3.1
- IBM AIX 4.3.2
- IBM AIX 4.3.3
- IBM AIX 5.1
- MandrakeSoft Mandrake Linux 7.1
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux Corporate Server 1.0.1
- MandrakeSoft Mandrake Single Network Firewall 7.2
- MIT Kerberos
- NetBSD NetBSD 1.5
- RedHat Linux 5.2
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
- SCO Caldera OpenLinux
- SCO Caldera OpenServer 5
- SGI IRIX 6.5
- Sun Solaris
- SUSE SuSE Linux 6.1
- SUSE SuSE Linux 6.2
- SUSE SuSE Linux 6.3
- SUSE SuSE Linux 6.4
- SUSE SuSE Linux 7.0
- SUSE SuSE Linux 7.1
- SUSE SuSE Linux 7.2
- Various vendors telnetd
- WindRiver BSDOS 4.0
- WindRiver BSDOS 4.0.1
- WindRiver BSDOS 4.1
- WindRiver BSDOS 4.2
Reported:
Jul 18, 2001
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net