Multiple Vendor Telnetd Buffer Overflow Vulnerability
BID:3064
Info
Multiple Vendor Telnetd Buffer Overflow Vulnerability
| Bugtraq ID: | 3064 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 18 2001 12:00AM |
| Updated: | Jul 18 2001 12:00AM |
| Credit: | Published in a TESO Security Advisory on July 18, 2001. |
| Vulnerable: |
Sun Solaris 2.5.1 Sun Solaris 8_sparc Sun Solaris 7.0 Sun Solaris 2.6 Sun Solaris 2.5 Sun Solaris 2.4 Sun Solaris 2.3 Sun Solaris 2.2 Sun Solaris 2.1 Sun Solaris 2.0 SGI IRIX 6.5.13 SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 SCO Open Server 5.0.6 SCO Open Server 5.0.5 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 2.5 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.3 OpenBSD OpenBSD 2.2 OpenBSD OpenBSD 2.1 OpenBSD OpenBSD 2.0 Netkit Linux Netkit 0.17 Netkit Linux Netkit 0.16 Netkit Linux Netkit 0.14 Netkit Linux Netkit 0.12 Netkit Linux Netkit 0.11 Netkit Linux Netkit 0.10 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 NetBSD NetBSD 1.4.3 NetBSD NetBSD 1.4.2 NetBSD NetBSD 1.4.1 NetBSD NetBSD 1.4 NetBSD NetBSD 1.3.3 NetBSD NetBSD 1.3.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 NetBSD NetBSD 1.2.1 NetBSD NetBSD 1.2 NetBSD NetBSD 1.1 NetBSD NetBSD 1.0 MIT Kerberos 5 1.2.2 MIT Kerberos 5 1.2.1 MIT Kerberos 5 1.2 MIT Kerberos 5 1.1.1 MIT Kerberos 5 1.1 MIT Kerberos 5 1.0 IBM AIX 4.3.3 IBM AIX 4.3.2 IBM AIX 4.3.1 IBM AIX 4.3 IBM AIX 5.1 HP Secure OS software for Linux 1.0 HP HP-UX 10.24 HP HP-UX 10.20 SIS HP HP-UX 10.20 HP HP-UX 10.10 HP HP-UX 10.0 1 FreeBSD FreeBSD 4.3 -STABLE FreeBSD FreeBSD 4.3 -RELEASE FreeBSD FreeBSD 4.2 -STABLE FreeBSD FreeBSD 4.2 -RELEASE FreeBSD FreeBSD 4.1.1 -STABLE FreeBSD FreeBSD 4.1.1 -RELEASE FreeBSD FreeBSD 4.0 .x FreeBSD FreeBSD 3.5.1 -STABLE FreeBSD FreeBSD 3.5.1 -RELEASE FreeBSD FreeBSD 3.x FreeBSD FreeBSD 2.x Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 Cisco Catalyst 6000 7.1 Cisco Catalyst 6000 6.3 (0.7)PAN Cisco Catalyst 6000 6.2 (0.111) Cisco Catalyst 6000 6.2 (0.110) Cisco Catalyst 6000 6.1 (2.13) Cisco Catalyst 6000 6.1 (1c) Cisco Catalyst 6000 6.1 (1b) Cisco Catalyst 6000 6.1 (1a) Cisco Catalyst 6000 6.1 (1) Cisco Catalyst 6000 5.5 (4b) Cisco Catalyst 6000 5.5 (4a) Cisco Catalyst 6000 5.5 (4) Cisco Catalyst 6000 5.5 (3) Cisco Catalyst 6000 5.5 (2) Cisco Catalyst 6000 5.5 (1) Cisco Catalyst 6000 5.5 Cisco Catalyst 6000 5.4.1 Cisco Catalyst 6000 5.4 (4) Cisco Catalyst 6000 5.4 (3) Cisco Catalyst 6000 5.4 (2) Cisco Catalyst 6000 5.4 (1) Cisco Catalyst 6000 5.4 Cisco Catalyst 6000 5.3 (6)CSX Cisco Catalyst 6000 5.3 (5a)CSX Cisco Catalyst 6000 5.3 (5)CSX Cisco Catalyst 6000 5.3 (4)CSX Cisco Catalyst 6000 5.3 (3)CSX Cisco Catalyst 6000 5.3 (2)CSX Cisco Catalyst 6000 5.3 (1a)CSX Cisco Catalyst 6000 5.3 (1)CSX Cisco Catalyst 5000 6.1 (3) Cisco Catalyst 5000 6.1 (2) Cisco Catalyst 5000 6.1 (1c) Cisco Catalyst 5000 6.1 (1b) Cisco Catalyst 5000 6.1 (1a) Cisco Catalyst 5000 6.1 (1) Cisco Catalyst 5000 5.5 (7) Cisco Catalyst 5000 5.5 (6) Cisco Catalyst 5000 5.5 (4b) Cisco Catalyst 5000 5.5 (4) Cisco Catalyst 5000 5.5 (3) Cisco Catalyst 5000 5.5 (2) Cisco Catalyst 5000 5.5 (1) Cisco Catalyst 5000 5.4.1 Cisco Catalyst 5000 5.4 (4) Cisco Catalyst 5000 5.4 (3) Cisco Catalyst 5000 5.4 (2) Cisco Catalyst 5000 5.4 (1) Cisco Catalyst 5000 5.2 (4) Cisco Catalyst 5000 5.2 (3) Cisco Catalyst 5000 5.2 (2) Cisco Catalyst 5000 5.2 (1) Cisco Catalyst 5000 5.2 Cisco Catalyst 5000 5.1 (2a) Cisco Catalyst 5000 5.1 (1) Cisco Catalyst 5000 5.1 Cisco Catalyst 5000 4.5 (9) Cisco Catalyst 5000 4.5 (8) Cisco Catalyst 5000 4.5 (7) Cisco Catalyst 5000 4.5 (6) Cisco Catalyst 5000 4.5 (5) Cisco Catalyst 5000 4.5 (4b) Cisco Catalyst 5000 4.5 (4) Cisco Catalyst 5000 4.5 (3) Cisco Catalyst 5000 4.5 (2) Cisco Catalyst 5000 4.5 (12) Cisco Catalyst 5000 4.5 (11) Cisco Catalyst 5000 4.5 (10) Cisco Catalyst 4000 7.1 Cisco Catalyst 4000 6.1 (1c) Cisco Catalyst 4000 6.1 (1b) Cisco Catalyst 4000 6.1 (1a) Cisco Catalyst 4000 6.1 (1) Cisco Catalyst 4000 5.5 (4b) Cisco Catalyst 4000 5.5 (4) Cisco Catalyst 4000 5.5 (3) Cisco Catalyst 4000 5.5 (2) Cisco Catalyst 4000 5.5 (1) Cisco Catalyst 4000 5.5 Cisco Catalyst 4000 5.4.1 Cisco Catalyst 4000 5.4 (3) Cisco Catalyst 4000 5.4 (2) Cisco Catalyst 4000 5.4 (1) Cisco Catalyst 4000 5.4 Cisco Catalyst 4000 5.2 (7) Cisco Catalyst 4000 5.2 (6) Cisco Catalyst 4000 5.2 (5) Cisco Catalyst 4000 5.2 (4) Cisco Catalyst 4000 5.2 (2) Cisco Catalyst 4000 5.2 (1a) Cisco Catalyst 4000 5.2 (1) Cisco Catalyst 4000 5.2 Cisco Catalyst 4000 5.1 (2a) Cisco Catalyst 4000 5.1 (1a) Cisco Catalyst 4000 5.1 (1) Cisco Catalyst 4000 5.1 Cisco Catalyst 4000 4.5 (9) Cisco Catalyst 4000 4.5 (8) Cisco Catalyst 4000 4.5 (7) Cisco Catalyst 4000 4.5 (6) Cisco Catalyst 4000 4.5 (5) Cisco Catalyst 4000 4.5 (4b) Cisco Catalyst 4000 4.5 (4) Cisco Catalyst 4000 4.5 (3) Cisco Catalyst 4000 4.5 (2) Cisco Catalyst 4000 4.5 (10) BSDI BSD/OS 4.2 BSDI BSD/OS 4.1 BSDI BSD/OS 4.0.1 BSDI BSD/OS 4.0 Apple Mac OS X 10.0 |
| Not Vulnerable: |
OpenBSD OpenBSD 2.9 Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.0.4 Cisco Catalyst 8500 Cisco Catalyst 6000 7.1 (2) Cisco Catalyst 6000 6.3 (4) Cisco Catalyst 6000 5.5 (13) Cisco Catalyst 5000 6.3 (4) Cisco Catalyst 5000 5.5 (13) Cisco Catalyst 5000 4.5 (13a) Cisco Catalyst 4908G-l3 Cisco Catalyst 4840G Cisco Catalyst 4800 Cisco Catalyst 4200 Cisco Catalyst 4000 7.1 (2) Cisco Catalyst 4000 6.3 (4) Cisco Catalyst 4000 5.5 (13) Cisco Catalyst 3900 Cisco Catalyst 3550 Cisco Catalyst 3500 XL Cisco Catalyst 2950 Cisco Catalyst 2948G-l3 Cisco Catalyst 2900 XL Cisco Catalyst 2900 LRE XL Cisco Catalyst 2820 Cisco Catalyst 2800 Cisco Catalyst 1900 Apple Mac OS X 10.1 |
Discussion
Multiple Vendor Telnetd Buffer Overflow Vulnerability
A boundary condition error exists in telnet daemons derived from the BSD telnet daemon.
Under certain circumstances, the buffer overflow can occur when a combination of telnet protocol options are received by the daemon. The function responsible for processing the options prepares a response within a fixed sized buffer, without performing any bounds checking.
This vulnerability is now being actively exploited. A worm is known to be circulating around the Internet.
A boundary condition error exists in telnet daemons derived from the BSD telnet daemon.
Under certain circumstances, the buffer overflow can occur when a combination of telnet protocol options are received by the daemon. The function responsible for processing the options prepares a response within a fixed sized buffer, without performing any bounds checking.
This vulnerability is now being actively exploited. A worm is known to be circulating around the Internet.
References
Multiple Vendor Telnetd Buffer Overflow Vulnerability
References:
References:
- CERT Advisory CA-2001-21: Buffer Overflow in telnetd (CERT/CC)
- Cisco Security Advisory: Cisco CatOS Telnet Buffer Vulnerability (Cisco Systems)
- Debian netkit telnetd vulnerability (Michal Zalewski