SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Telnet Vendors:   OpenBSD
(OpenBSD Issues Fix) Telnet Client Buffer Overflow in slc_add_reply() and env_opt_add() Lets Remote Servers Execute Arbitrary Code
SecurityTracker Alert ID:  1013612
SecurityTracker URL:  http://securitytracker.com/id/1013612
CVE Reference:   CVE-2005-0468, CVE-2005-0469   (Links to External Site)
Date:  Mar 30 2005
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   iDEFENSE reported two buffer overflow vulnerabilities in Telnet, affecting several vendor implementations. A remote server can execute arbitrary code on a connected target user's client.

A remote telnet server can send a large number of specially crafted LINEMODE Set Local Character (SLC) commands to trigger an overflow in the slc_add_reply() function.

Solar Designer has provided the following demonstration exploit:

perl -e 'print "\377", "\372\42\3\377\377\3\3" x 43, "\377\360"' | nc -l 23

A remote server can also return specially crafted characters that will be escaped by the target user's client, overflowing a buffer in the env_opt_add() function.

Arbitrary code can be executed with the privileges of the target user.

Several telnet client implementations are affected.

The vendors were notified on February 18, 2005.

The original advisories are available at:

http://www.idefense.com/application/poi/display?id=220&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities

Impact:   A remote server can execute arbitrary code on a connected target user's system with the privileges of the target user.
Solution:   OpenBSD has issued the following patches:

ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/031_telnet.patch
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/014_telnet.patch

Vendor URL:  www.openbsd.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (OpenBSD)
Underlying OS Comments:  3.5, 3.6

Message History:   This archive entry is a follow-up to the message listed below.
Mar 28 2005 Telnet Client Buffer Overflow in slc_add_reply() and env_opt_add() Lets Remote Servers Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC