xtell Multiple Remote Buffer Overflow Vulnerabilities
BID:4193
Info
xtell Multiple Remote Buffer Overflow Vulnerabilities
| Bugtraq ID: | 4193 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-0332 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 27 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | Discovered by "Spybreak" <[email protected]>. |
| Vulnerable: |
xtell xtell 2.6.1 xtell xtell 1.91.1 |
| Not Vulnerable: | |
Discussion
xtell Multiple Remote Buffer Overflow Vulnerabilities
xtell is a simple network messaging program. It may be used to transmit terminal messages between users and machines. xtell is available for Linux, BSD and most other Unix based operating systems.
Multiple buffer overflow vulnerabilities have been reported in some versions of xtell. If long strings are recieved by the xtell client, stack memory will be overwritten. Exploitation of these vulnerabilities may result in arbitrary code being executed as the xtell daemon.
Overflow conditions may be caused if long strings are sent by a malicious DNS server in response to the reverse lookup performed when a message is received, either through the auth string returned by the ident server, or through directly sending an overly long message to the vulnerable user.
Earlier versions of xtell may share some or all of these vulnerabilities. This has not been confirmed.
xtell is a simple network messaging program. It may be used to transmit terminal messages between users and machines. xtell is available for Linux, BSD and most other Unix based operating systems.
Multiple buffer overflow vulnerabilities have been reported in some versions of xtell. If long strings are recieved by the xtell client, stack memory will be overwritten. Exploitation of these vulnerabilities may result in arbitrary code being executed as the xtell daemon.
Overflow conditions may be caused if long strings are sent by a malicious DNS server in response to the reverse lookup performed when a message is received, either through the auth string returned by the ident server, or through directly sending an overly long message to the vulnerable user.
Earlier versions of xtell may share some or all of these vulnerabilities. This has not been confirmed.
Exploit / POC
xtell Multiple Remote Buffer Overflow Vulnerabilities
An exploit has been provided by Spybreak <[email protected]>:
An exploit has been provided by Spybreak <[email protected]>:
Solution / Fix
xtell Multiple Remote Buffer Overflow Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
xtell xtell 1.91.1
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
xtell xtell 1.91.1
-
Debian xtell_1.91.1_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/xtel l_1.91.1_alpha.deb -
Debian xtell_1.91.1_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/xtell_ 1.91.1_arm.deb -
Debian xtell_1.91.1_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/xtell _1.91.1_i386.deb -
Debian xtell_1.91.1_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/xtell _1.91.1_m68k.deb -
Debian xtell_1.91.1_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/xt ell_1.91.1_powerpc.deb -
Debian xtell_1.91.1_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/xtel l_1.91.1_sparc.deb