SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Telnet Vendors:   [Multiple Authors/Vendors]
(Caldera Issues Fix for SCO) Telnet Daemons May Give Remote Users Root Level Access Privileges
SecurityTracker Alert ID:  1002162
SecurityTracker URL:  http://securitytracker.com/id/1002162
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Aug 8 2001
Impact:   Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): OpenServer 5.0.5, 5.0.6
Description:   TESO reported that many BSD-derived Telnet daemons (servers) contain a vulnerability that may allow a remote user to obtain root level access on the server.

The vulnerability is reportedly due to a buffer overflow in the telnet option handling.

The following systems are reported to be vulnerable:

BSDI 4.x default, FreeBSD [2345].x default, IRIX 6.5, Linux netkit-telnetd < 0.14, NetBSD 1.x default, OpenBSD 2.x, Solaris 2.x sparc, and "almost any other vendor's telnetd".

A remote user can send a specially formatted option string to the remote telnet server and overwrite sensitive memory, causing arbitrary code to be executed with the privileges of the telnet server (which is typically root level privileges).

Telnet options are reportedly processed by the 'telrcv' function. The results of the parsing, which are to be send back to the client, are stored in the 'netobuf' buffer. It is apparently assumed that the reply data is smaller than the buffer size, so no bounds checking is performed. By using a combination of options, especially the 'AYT' Are You There option, it is possible for a remote user to append data to the buffer. It is reported that the characters that can be written to the buffer are limited, which makes constructing a successful exploit difficult.

The report states that a working exploit has been developed for BSDI, NetBSD and FreeBSD. However, the exploit was not released.

Impact:   A remote user can execute arbitrary code on the server with the privileges of the telnet server, which is typically root level privileges.
Solution:   The vendor has released a fix. See the Source Message for the vendor's advisory containing directions on how to obtain the appropriate fix.
Cause:   Boundary error
Underlying OS:  UNIX (Open UNIX-SCO)
Underlying OS Comments:  many Linux and Unix OSs are vulnerable, but not all - see the Alert text for more information

Message History:   This archive entry is a follow-up to the message listed below.
Jul 18 2001 Telnet Daemons May Give Remote Users Root Level Access Privileges



 Source Message Contents

Subject:  Security Update: [CSSA-2001-SCO.10]: OpenServer: /etc/telnetd buffer


--------------5A8E1CD7F88FFAAADDCCAA0B
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

To: announce@lists.caldera.com bugtraq@securityfocus.com
security-announce@lists.securityportal.com



--------------5A8E1CD7F88FFAAADDCCAA0B
Content-Type: text/plain; charset=us-ascii;
 name="CSSA.10"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="CSSA.10"

___________________________________________________________________________

            Caldera International, Inc. Security Advisory

Subject:                OpenServer 5.0.5, 5.0.6: telnetd buffer overflow
Advisory number:        CSSA-2001-SCO.10
Issue date:             2001 August 7
Cross reference:
___________________________________________________________________________



1. Problem Description
        
        The telnet daemon /etc/telnetd is subject to a buffer
        overflow problem that could be used by a malicious user to
        gain unauthorized access to a system.


2. Vulnerable Versions

        Operating System        Version         Affected Files
        ------------------------------------------------------------------
        OpenServer 5            All             /etc/telnetd

3. Workaround

        None.


4. OpenServer

  4.1 Location of Fixed Binaries

        ftp://ftp.sco.com/pub/security/openserver/sr849876/


  4.2 Verification

        md5 checksums:
        
        a3fead5326b361cc9a94f0376fdf0f10        telnetd.Z
        5e7d80c80b1ac2fcde9fc227f6793881        libresolv.so.1.Z
        a5b4e98ace9c64b2129ca53688a98650        libsocket.so.2.Z


        md5 is available for download from

                ftp://ftp.sco.com/pub/security/tools/


  4.3 Installing Fixed Binaries

        Save the erg711793a.Z compressed tar archive into /tmp, and
        install/upgrade the affected binaries with the following commands:

        # cd /tmp
        # uncompress erg711793a.Z
        # tar xvf erg711793a
        # uncompress telnetd
        # mv /etc/telnetd /etc/telnetd.old
        # cp telnetd /etc
        # chown bin:bin /etc/telnetd
        # chmod 711 /etc/telnetd

        In addition, on any pre-5.0.6 system, or on any 5.0.6 system 
        without rs506a, execute the following commands:

        # uncompress libsocket.so.2
        # uncompress libresolv.so.1
        # cp libresolv.so.1 /usr/lib
        # cp libsocket.so.2 /usr/lib
        # chown bin:bin /usr/lib/libresolv.so.1
        # chown bin:bin /usr/lib/libsocket.so.2
        # chmod 555 /usr/lib/libresolv.so.1
        # chmod 555 /usr/lib/libsocket.so.2


5. References

        http://www.calderasystems.com/support/security/index.html


6. Disclaimer

        Caldera International, Inc. is not responsible for the misuse
        of any of the information we provide on our website and/or
        through our security advisories. Our advisories are a service
        to our customers intended to promote secure installation and
        use of Caldera International products.


7.Acknowledgements

        Caldera International would like to thank Sebastian
        <scut@nb.in-berlin.de> for his posting on bugtraq, and KF
        <dotslash@snosoft.com> for reporting the problem to us.
         
___________________________________________________________________________

--------------5A8E1CD7F88FFAAADDCCAA0B
Content-Type: text/plain; charset=us-ascii;
 name="CSSA.10.asc"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="CSSA.10.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEABECAAYFAjtwgocACgkQom1bqoqwkdT4VgCffDi3JtUqtDbxip/qOBbDvi+0
gWcAoIaurZJPLfJt2N7UpdMmFY8Pto7Q
=w6aP
-----END PGP SIGNATURE-----


--------------5A8E1CD7F88FFAAADDCCAA0B
Content-Type: text/plain; charset=us-ascii

---------------------------------------------------------------------
To unsubscribe, e-mail: announce-unsubscribe@lists.caldera.com
For additional commands, e-mail: announce-help@lists.caldera.com
--------------5A8E1CD7F88FFAAADDCCAA0B--


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC