Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerability
BID:11313
Info
Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerability
| Bugtraq ID: | 11313 |
| Class: | Design Error |
| CVE: |
CVE-2004-0911 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 03 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | This vulnerability was reported to the vendor by Michal Zalewski. |
| Vulnerable: |
Debian telnetd-ssl 0.17.17 +0.1-2woody1 Debian telnetd-ssl 0.17.17 +0.1-2 Debian telnetd-ssl 0.17.17 +0.1-1 Debian telnetd 0.17 -25 Debian telnetd 0.17 -18 |
| Not Vulnerable: |
Debian telnetd-ssl 0.17.17 +0.1-2woody2 Debian telnetd 0.17 -26 Debian telnetd 0.17 -18woody1 |
Discussion
Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerability
Telnetd as provided by Debian/GNU Linux is reported susceptible to an invalid memory handling vulnerability. This issue is due to a failure of the application to ensure that memory buffers are properly allocated and deallocated.
It is conjectured that attackers may potentially leverage this vulnerability to execute code in the context of the telnetd process. Debian GNU/Linux runs the process as the unprivileged 'telnetd' user by default.
Versions of telnetd prior to 0.17-18woody1 for the stable branch, and 0.17-26 for the unstable branch are reported to be affected by this vulnerability.
Telnetd as provided by Debian/GNU Linux is reported susceptible to an invalid memory handling vulnerability. This issue is due to a failure of the application to ensure that memory buffers are properly allocated and deallocated.
It is conjectured that attackers may potentially leverage this vulnerability to execute code in the context of the telnetd process. Debian GNU/Linux runs the process as the unprivileged 'telnetd' user by default.
Versions of telnetd prior to 0.17-18woody1 for the stable branch, and 0.17-26 for the unstable branch are reported to be affected by this vulnerability.
Exploit / POC
Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerability
Solution:
Debian GNU/Linux has released advisory DSA 556-1, along with fixes to address this issue.
Debian Linux has released advisory DSA 569-1 dealing with this issue for their telnet-ssl distribution. Please see the referenced advisory for more information.
Debian has released DSA 556-2, which is a revision to their first advisory. This revision includes new fixes that reportedly resolve the issue where the original fixes did not. Please see the referenced advisory for more information.
Debian telnetd 0.17 -18
Debian telnetd-ssl 0.17.17 +0.1-2woody1
Solution:
Debian GNU/Linux has released advisory DSA 556-1, along with fixes to address this issue.
Debian Linux has released advisory DSA 569-1 dealing with this issue for their telnet-ssl distribution. Please see the referenced advisory for more information.
Debian has released DSA 556-2, which is a revision to their first advisory. This revision includes new fixes that reportedly resolve the issue where the original fixes did not. Please see the referenced advisory for more information.
Debian telnetd 0.17 -18
-
Debian telnet_0.17-18woody1_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_alpha.deb -
Debian telnet_0.17-18woody1_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_arm.deb -
Debian telnet_0.17-18woody1_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_hppa.deb -
Debian telnet_0.17-18woody1_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_i386.deb -
Debian telnet_0.17-18woody1_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_ia64.deb -
Debian telnet_0.17-18woody1_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_m68k.deb -
Debian telnet_0.17-18woody1_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_mips.deb -
Debian telnet_0.17-18woody1_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_mipsel.deb -
Debian telnet_0.17-18woody1_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_powerpc.deb -
Debian telnet_0.17-18woody1_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_s390.deb -
Debian telnet_0.17-18woody1_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnet_0. 17-18woody1_sparc.deb -
Debian telnetd_0.17-18woody1_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_alpha.deb -
Debian telnetd_0.17-18woody1_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_arm.deb -
Debian telnetd_0.17-18woody1_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_hppa.deb -
Debian telnetd_0.17-18woody1_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_i386.deb -
Debian telnetd_0.17-18woody1_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_ia64.deb -
Debian telnetd_0.17-18woody1_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_m68k.deb -
Debian telnetd_0.17-18woody1_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_mips.deb -
Debian telnetd_0.17-18woody1_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_mipsel.deb -
Debian telnetd_0.17-18woody1_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_powerpc.deb -
Debian telnetd_0.17-18woody1_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_s390.deb -
Debian telnetd_0.17-18woody1_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet/telnetd_0 .17-18woody1_sparc.deb
Debian telnetd-ssl 0.17.17 +0.1-2woody1
-
Debian telnet-ssl_0.17.17+0.1-2woody2_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_alpha.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_arm.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_hppa.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_i386.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_ia64.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_m68k.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_mips.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_mipsel.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_powerpc.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_s390.deb -
Debian telnet-ssl_0.17.17+0.1-2woody2_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne t-ssl_0.17.17+0.1-2woody2_sparc.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_alpha.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_arm.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_hppa.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_i386.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_ia64.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_m68k.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_mips.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_mipsel.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_powerpc.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_s390.deb -
Debian telnetd-ssl_0.17.17+0.1-2woody2_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/n/netkit-telnet-ssl/telne td-ssl_0.17.17+0.1-2woody2_sparc.deb
References
Debian GNU/Linux Telnetd Invalid Memory Handling Vulnerability
References:
References:
- Bug report logs - #273694 - telnetd DoS (Debian GNU/Linux)
- Debian Security Information (Debian GNU/Linux)