SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Telnet Vendors:   [Multiple Authors/Vendors]
(NetBSD Issues Fix) Telnet Daemons May Give Remote Users Root Level Access Privileges
SecurityTracker Alert ID:  1002095
SecurityTracker URL:  http://securitytracker.com/id/1002095
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jul 27 2001
Impact:   Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   TESO reported that many BSD-derived Telnet daemons (servers) contain a vulnerability that may allow a remote user to obtain root level access on the server.

The vulnerability is reportedly due to a buffer overflow in the telnet option handling.

The following systems are reported to be vulnerable:

BSDI 4.x default, FreeBSD [2345].x default, IRIX 6.5, Linux netkit-telnetd < 0.14, NetBSD 1.x default, OpenBSD 2.x, Solaris 2.x sparc, and "almost any other vendor's telnetd".

A remote user can send a specially formatted option string to the remote telnet server and overwrite sensitive memory, causing arbitrary code to be executed with the privileges of the telnet server (which is typically root level privileges).

Telnet options are reportedly processed by the 'telrcv' function. The results of the parsing, which are to be send back to the client, are stored in the 'netobuf' buffer. It is apparently assumed that the reply data is smaller than the buffer size, so no bounds checking is performed. By using a combination of options, especially the 'AYT' Are You There option, it is possible for a remote user to append data to the buffer. It is reported that the characters that can be written to the buffer are limited, which makes constructing a successful exploit difficult.

The report states that a working exploit has been developed for BSDI, NetBSD and FreeBSD. However, the exploit was not released.

Impact:   A remote user can execute arbitrary code on the server with the privileges of the telnet server, which is typically root level privileges.
Solution:   The vendor has released a fix. See the Source Message for the vendor's advisory containing directions on how to obtain the appropriate fix.
Cause:   Boundary error
Underlying OS:  UNIX (NetBSD)
Underlying OS Comments:  many Linux and Unix OSs are vulnerable, but not all - see the Alert text for more information

Message History:   This archive entry is a follow-up to the message listed below.
Jul 18 2001 Telnet Daemons May Give Remote Users Root Level Access Privileges



 Source Message Contents

Subject:  NetBSD Security Advisory 2001-012: telnetd(8) options overflow


-----BEGIN PGP SIGNED MESSAGE-----


                 NetBSD Security Advisory 2001-012
                 =================================

Topic:		telnetd(8) options overflow

Version:	All NetBSD releases prior to 2001-07-19.

Severity:	remote root from any host which can connect to telnetd(8)

Fixed:		NetBSD-current:		2001-07-19.
		NetBSD-1.5 branch:	Supplied patch (see below).
		NetBSD-1.4 branch:	Supplied patch (see below).

		A patch is provided for all releases that will fix
		the problem.  Pullups to other branches are
		anticipated, see 'More Information' below for how to
		track this progress.

Abstract
========

A buffer overflow existed in the telnetd(8) program. Any client
connecting could cause the telnetd instance to SEGV, and possibly
to execute arbitrary code as root.


Technical Details
=================

Technical details of the vulnerabilities are publicised in
CERT Advisory CA-2001-21:
	http://www.cert.org/advisories/CA-2001-21.html

A strong indication of attempted exploitation of this bug may be found
by examining log entries sent to the syslogd(8) system logger facility
DAEMON (which is stored in /var/log/messages by default) of the form:
	telnetd \[[0-9]*\]: ttloop: peer died: No such file or directory


Solutions and Workarounds
=========================

telnetd(8) has been shipped disabled since June 2000, including the
NetBSD 1.5 and 1.5.1 releases, and -current after that date.

If you are running an earlier release, or have re-enabled telnetd(8)
in 1.5.x, disable it now by commenting out the line beginning with
telnetd(8) in /etc/inetd.conf, and kill -HUP your inetd process.

As a reminder, unless you are running on a private network, telnet
exposes your passwords to the Internet. Even on a private network,
passwords may be exposed to inappropriate individuals. Use a strong,
secure protocol, such as Secure Shell instead.

The following instructions describe how to upgrade your telnetd(8)
by updating your source tree and rebuilding and installing a new
version of telnetd(8).

* NetBSD-current:

	Systems running NetBSD-current dated from before 2001-07-19
	should be upgraded to NetBSD-current dated 2001-07-20 or later.

	The following directory needs to be updated from the
	netbsd-current CVS branch (aka HEAD):
		src/libexec/telnetd

	To update from CVS, re-build, and re-install telnetd(8):
		# cd src/libexec/telnetd
		# cvs update -d -P
		# make cleandir dependall install


	Alternatively, apply the following patch (with potential offset
	differences) and rebuild & re-install telnetd(8):
		ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-012-telnetd.patch

	To patch, re-build and re-install telnetd(8):
		# cd src/libexec/telnetd
		# patch < SA2001-012-telnetd.patch
		# make cleandir dependall install


* NetBSD 1.3, 1.3.x, 1.4, 1.4.x, 1.5, 1.5.1

	Systems running NetBSD releases up to and including 1.5.1 should
	apply the following patch (with potential offset differences):
		ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-012-telnetd.patch

	To patch, re-build and re-install telnetd(8):
		# cd src/libexec/telnetd
		# patch < SA2001-012-telnetd.patch
		# make cleandir dependall install


	The anonymous CVS branchs netbsd-1-4 and netbsd-1-5 should be
	updated with a fix in the near future.


Thanks To
=========

TESO for the advisory.

Jason Thorpe <thorpej@netbsd.org> for analysis.

Krister Walfridsson <kristerw@netbsd.org> for testing.

Jun-ichiro Hagino <itojun@netbsd.org> for a fix in NetBSD-current
from the Heimdal telnetd sources, by way of OpenBSD.

David Maxwell <david@netbsd.org> for the fix for previous releases.


Revision History
================

	2001-07-25	Initial revision.

	2001-07-25	Info on how to detect exploit attempts.


More Information
================

An up-to-date PGP signed copy of this release will be maintained at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-012.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 2001, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA2001-012.txt,v 1.12 2001/07/25 13:09:47 lukem Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (NetBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBO17FAz5Ru2/4N2IFAQFDSwP/U8mVWa8bxZDj9/1jpyfJ4DkYTjTUBqty
TVfqAlEfCJuFe7ftdNds9915yOEYWiqP6xYg3gZKn8c+4UqSQttXpZPW3QIuxg/k
hAiZ3IToWdAKq20YdqbA/BAV3wqHAd0cB8Hu/p1kfuq2rsF5kY0PvTb8z9njGsMJ
Rh7fC+Xyh/c=
=q48s
-----END PGP SIGNATURE-----


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC