SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Telnet Vendors:   FreeBSD
(FreeBSD Issues Fix) Telnet Client Buffer Overflow in slc_add_reply() and env_opt_add() Lets Remote Servers Execute Arbitrary Code
SecurityTracker Alert ID:  1013576
SecurityTracker URL:  http://securitytracker.com/id/1013576
CVE Reference:   CVE-2005-0468, CVE-2005-0469   (Links to External Site)
Date:  Mar 28 2005
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   iDEFENSE reported two buffer overflow vulnerabilities in Telnet, affecting several vendor implementations. A remote server can execute arbitrary code on a connected target user's client.

A remote telnet server can send a large number of specially crafted LINEMODE Set Local Character (SLC) commands to trigger an overflow in the slc_add_reply() function.

Solar Designer has provided the following demonstration exploit:

perl -e 'print "\377", "\372\42\3\377\377\3\3" x 43, "\377\360"' | nc -l 23

A remote server can also return specially crafted characters that will be escaped by the target user's client, overflowing a buffer in the env_opt_add() function.

Arbitrary code can be executed with the privileges of the target user.

Several telnet client implementations are affected.

The vendors were notified on February 18, 2005.

The original advisories are available at:

http://www.idefense.com/application/poi/display?id=220&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities

Impact:   A remote server can execute arbitrary code on a connected target user's system with the privileges of the target user.
Solution:   FreeBSD has released patches for FreeBSD 4.8, 4.10, 4.11, and 5.3 systems.

[FreeBSD 4.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet4.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet4.patch.asc

[FreeBSD 5.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet5.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet5.patch.asc

Vendor URL:  www.freebsd.org/security/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (FreeBSD)
Underlying OS Comments:  4.8, 4.10, 4.11, and 5.3

Message History:   This archive entry is a follow-up to the message listed below.
Mar 28 2005 Telnet Client Buffer Overflow in slc_add_reply() and env_opt_add() Lets Remote Servers Execute Arbitrary Code



 Source Message Contents

Subject:  FreeBSD Security Advisory FreeBSD-SA-05:01.telnet


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-05:01.telnet                                     Security Advisory
                                                          The FreeBSD Project

Topic:          telnet client buffer overflows

Category:       contrib
Module:         contrib/telnet
Announced:      2005-03-28
Credits:        iDEFENSE
Affects:        All FreeBSD releases prior to 5.4-RELEASE
Corrected:      2005-03-28 15:50:00 UTC (RELENG_5, 5.4-PRERELEASE)
                2005-03-28 15:48:00 UTC (RELENG_4, 4.11-STABLE)
                2005-03-28 15:52:00 UTC (RELENG_5_3, 5.3-RELEASE-p6)
                2005-03-28 15:57:00 UTC (RELENG_4_11, 4.11-RELEASE-p1)
                2005-03-28 15:58:00 UTC (RELENG_4_10, 4.10-RELEASE-p6)
                2005-03-28 16:00:00 UTC (RELENG_4_8, 4.8-RELEASE-p28)
CVE Name:       CAN-2005-0468 CAN-2005-0469

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

I.   Background

The telnet(1) command is a TELNET protocol client, used primarily to
establish terminal sessions across a network.

II.  Problem Description

Buffer overflows were discovered in the env_opt_add() and
slc_add_reply() functions of the telnet(1) command.  TELNET protocol
commands, options, and data are copied from the network to a
fixed-sized buffer.  In the case of env_opt_add (CAN-2005-0468), the
buffer is located on the heap.  In the case of slc_add_reply
(CAN-2005-0469), the buffer is global uninitialized data (BSS).

III. Impact

These buffer overflows may be triggered when connecting to a malicious
server, or by an active attacker in the network path between the
client and server.  Specially crafted TELNET command sequences may
cause the execution of arbitrary code with the privileges of the user
invoking telnet(1).

IV.  Workaround

Do not use telnet(1) to connect to untrusted machines or over an
untrusted network.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to 4-STABLE or 5-STABLE, or to the
RELENG_5_3, RELENG_4_11, RELENG_4_10, or RELENG_4_8 security branch
dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 4.8, 4.10,
4.11, and 5.3 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 4.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet4.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet4.patch.asc

[FreeBSD 5.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet5.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:01/telnet5.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Rebuild the operating system as described in
<URL:http://www.freebsd.org/doc/handbook/makeworld.html>.

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch                                                           Revision
  Path
- -------------------------------------------------------------------------
RELENG_4
  src/crypto/heimdal/appl/telnet/telnet/telnet.c              1.1.1.1.2.4
  src/crypto/kerberosIV/appl/telnet/telnet/telnet.c           1.1.1.1.2.1
  src/crypto/telnet/telnet/telnet.c                               1.4.2.6
  src/usr.bin/telnet/telnet.c                                     1.8.2.4
RELENG_4_11
  src/UPDATING                                              1.73.2.91.2.2
  src/crypto/heimdal/appl/telnet/telnet/telnet.c         1.1.1.1.2.3.10.1
  src/crypto/kerberosIV/appl/telnet/telnet/telnet.c          1.1.1.1.22.1
  src/crypto/telnet/telnet/telnet.c                          1.4.2.5.12.1
  src/sys/conf/newvers.sh                                   1.44.2.39.2.5
  src/usr.bin/telnet/telnet.c                                1.8.2.3.12.1
RELENG_4_10
  src/UPDATING                                              1.73.2.90.2.7
  src/crypto/heimdal/appl/telnet/telnet/telnet.c          1.1.1.1.2.3.8.1
  src/crypto/kerberosIV/appl/telnet/telnet/telnet.c          1.1.1.1.20.1
  src/crypto/telnet/telnet/telnet.c                          1.4.2.5.10.1
  src/sys/conf/newvers.sh                                   1.44.2.34.2.8
  src/usr.bin/telnet/telnet.c                                1.8.2.3.10.1
RELENG_4_8
  src/UPDATING                                             1.73.2.80.2.32
  src/crypto/heimdal/appl/telnet/telnet/telnet.c          1.1.1.1.2.3.4.1
  src/crypto/kerberosIV/appl/telnet/telnet/telnet.c          1.1.1.1.16.1
  src/crypto/telnet/telnet/telnet.c                           1.4.2.5.6.1
  src/sys/conf/newvers.sh                                  1.44.2.29.2.29
  src/usr.bin/telnet/telnet.c                                 1.8.2.3.6.1
RELENG_5
  src/contrib/telnet/telnet/telnet.c                             1.14.6.1
RELENG_5_3
  src/UPDATING                                             1.342.2.13.2.9
  src/contrib/telnet/telnet/telnet.c                             1.14.8.1
  src/sys/conf/newvers.sh                                  1.62.2.15.2.11
- -------------------------------------------------------------------------

VII. References

[IDEF0866] Multiple Telnet Client slc_add_reply() Buffer Overflow
http://www.idefense.com/application/poi/display?id=220&type=vulnerabilities

[IDEF0867] Multiple Telnet Client env_opt_add() Buffer Overflow
http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0

iD8DBQFCSECrFdaIBMps37IRAnRJAJ0VbP6TyaX7SLE2EwSrIYU25JSD9wCfYoe9
Qg2Lw/6QFLOgYG1jPuzogEs=
=0rFv
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security-notifications@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications
To unsubscribe, send any mail to "freebsd-security-notifications-unsubscribe@freebsd.org"

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC