Hilgraeve HyperTerminal Telnet Buffer Overflow Vulnerability

Bugtraq ID:	1815
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 18 2000 12:00AM
Updated:	Oct 18 2000 12:00AM
Credit:	Discovered by USSR Labs <[email protected]> and publicized in a Microsoft Security Bulletin (MS00-079) on October 18, 2000.
Vulnerable:	Hilgraeve HyperTerminal 6.0 + Microsoft Windows 2000 Professional + Microsoft Windows 98 + Microsoft Windows 98SE + Microsoft Windows ME + Microsoft Windows NT 4.0
Not Vulnerable:	Hilgraeve HyperTerminal 6.1 + Microsoft Windows 2000 Professional + Microsoft Windows 98 + Microsoft Windows 98SE + Microsoft Windows ME + Microsoft Windows NT 4.0

Hilgraeve HyperTerminal Telnet Buffer Overflow Vulnerability

telnet://<string consisting of over 153 characters>

Hilgraeve HyperTerminal Telnet Buffer Overflow Vulnerability

Solution:
Microsoft has released patches for each vulnerable operating system HyperTerminal is installed with. In addition, Hilgraeve has made an upgrade for HyperTerminal Private Edition available:

http://www.hilgraeve.com/htpe/download.html


Hilgraeve HyperTerminal 6.0

• Microsoft Q274548
  Patch for Windows 98/98 SE
  http://download.microsoft.com/download/win98/Update/12395/W98/EN-US/27 4548USA8.EXE


• Microsoft Q274548
  Patch for Windows ME
  http://download.microsoft.com/download/winme/Update/12395/WinMe/EN-US/ 274548USAM.EXE


• Microsoft Q276471
  http://download.microsoft.com/download/win2000platform/Patch/Q276471/N T5/EN-US/Q276471_W2K_SP2_x86_en.EXE

Hilgraeve HyperTerminal Telnet Buffer Overflow Vulnerability

References:

• Frequently Asked Questions: Microsoft Security Bulletin (MS00-079) (Microsoft)
  
• HyperTerminal Private Edition 6.1 Plugs Windows Security Hole (Hilgraeve)