SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Telnet Vendors:   Sun
(Solaris is Vulnerable) Telnet Client Buffer Overflow in slc_add_reply() and env_opt_add() Lets Remote Servers Execute Arbitrary Code
SecurityTracker Alert ID:  1013595
SecurityTracker URL:  http://securitytracker.com/id/1013595
CVE Reference:   CVE-2005-0468, CVE-2005-0469   (Links to External Site)
Date:  Mar 29 2005
Impact:   Execution of arbitrary code via network, User access via network
Vendor Confirmed:  Yes  

Description:   iDEFENSE reported two buffer overflow vulnerabilities in Telnet, affecting several vendor implementations. A remote server can execute arbitrary code on a connected target user's client.

A remote telnet server can send a large number of specially crafted LINEMODE Set Local Character (SLC) commands to trigger an overflow in the slc_add_reply() function.

Solar Designer has provided the following demonstration exploit:

perl -e 'print "\377", "\372\42\3\377\377\3\3" x 43, "\377\360"' | nc -l 23

A remote server can also return specially crafted characters that will be escaped by the target user's client, overflowing a buffer in the env_opt_add() function.

Arbitrary code can be executed with the privileges of the target user.

Several telnet client implementations are affected.

The vendors were notified on February 18, 2005.

The original advisories are available at:

http://www.idefense.com/application/poi/display?id=220&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities

Impact:   A remote server can execute arbitrary code on a connected target user's system with the privileges of the target user.
Solution:   Sun is working on a fix.

Sun has provided the following workaround [quoted]:

To work around the described issue until patches are available, sites may consider
removing the execute permissions from the Solaris telnet(1) utility. To accomplish
this, the following command can be run (as "root"):

# chmod 000 /usr/bin/telnet

To restore the original permissions to the telnet(1) utility (after the patches have
been applied) the following command can be run (as "root"):

# chmod 555 /usr/bin/telnet

Vendor URL:  sunsolve.sun.com/search/document.do?assetkey=1-26-57755-1 (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (Solaris - SunOS)
Underlying OS Comments:  7, 8, 9, and 10

Message History:   This archive entry is a follow-up to the message listed below.
Mar 28 2005 Telnet Client Buffer Overflow in slc_add_reply() and env_opt_add() Lets Remote Servers Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC