Celestial Software AbsoluteTelnet Title Bar Buffer Overflow Vulnerability
BID:6785
Info
Celestial Software AbsoluteTelnet Title Bar Buffer Overflow Vulnerability
| Bugtraq ID: | 6785 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 06 2003 12:00AM |
| Updated: | Feb 06 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to Knud Erik Hojgaard. |
| Vulnerable: |
Celestial Software AbsoluteTelnet 2.11 Celestial Software AbsoluteTelnet 2.0 0 |
| Not Vulnerable: |
Celestial Software AbsoluteTelnet 2.12 RC10 |
Discussion
Celestial Software AbsoluteTelnet Title Bar Buffer Overflow Vulnerability
A buffer overflow vulnerability was reported for AbsoluteTelnet. The vulnerability exists due to insufficient bounds checking performed when setting the title bar of the client.
An attacker can exploit this vulnerability by enticing a victim user to view a website with malicious HTML tags. This will cause the buffer overflow condition. Code execution may be possible.
A buffer overflow vulnerability was reported for AbsoluteTelnet. The vulnerability exists due to insufficient bounds checking performed when setting the title bar of the client.
An attacker can exploit this vulnerability by enticing a victim user to view a website with malicious HTML tags. This will cause the buffer overflow condition. Code execution may be possible.
Exploit / POC
Celestial Software AbsoluteTelnet Title Bar Buffer Overflow Vulnerability
The following exploit is available:
The following exploit is available:
Solution / Fix
Celestial Software AbsoluteTelnet Title Bar Buffer Overflow Vulnerability
Solution:
It has been reported that AbsoluteTelnet 2.12 is not vulnerable to this issue. It should be noted that this is a beta version of the software and as such may be unstable. Caution is advised before deploying beta software.
Celestial Software AbsoluteTelnet 2.0 0
Celestial Software AbsoluteTelnet 2.11
Solution:
It has been reported that AbsoluteTelnet 2.12 is not vulnerable to this issue. It should be noted that this is a beta version of the software and as such may be unstable. Caution is advised before deploying beta software.
Celestial Software AbsoluteTelnet 2.0 0
-
Celestial Software AbsoluteTelnet 2.12 RC10
http://www.celestialsoftware.net/telnet/beta_software.html
Celestial Software AbsoluteTelnet 2.11
-
Celestial Software AbsoluteTelnet 2.12 RC10
http://www.celestialsoftware.net/telnet/beta_software.html
References
Celestial Software AbsoluteTelnet Title Bar Buffer Overflow Vulnerability
References:
References:
- AbsoluteTelnet (Celestial Software)
- AbsoluteTelnet 2.00 buffer overflow. (Knud Erik Hojgaard)
- AbsoluteTelnet 2.00 buffer overflow. (=?iso-8859-1?Q?Knud_Erik_H=F8jgaard?=