CERT/CC Vulnerability Note VU#745371

Overview

The telnetd program is a server for the telnet remote virtual terminal protocol. There is a remotely exploitable buffer overflow in telnet daemons derived from BSD source code. This vulnerability can crash the server, or be leveraged to gain root access.

Description

There is a remotely exploitable buffer overflow in telnet daemons derived from BSD source code. The buffer overflow occurs in the server's processing of protocol options. A function of the telnet daemon, 'telrcv', processes the protocol options. During the processing of the options, the results of 'telrcv' are assumed to be smaller than an unchecked storage buffer. The size of this buffer is statically defined.

TESO claims that they have a working exploit for the BSDI, FreeBSD, and NetBSD versions affected(see http://www.team-teso.net/advisories/teso-advisory-011.tar.gz). Their exploit has been publicly posted on the BugTraq mailing list. We have verified the exploit works against at least one target system.

According to a TESO advisory, the following systems with telnetd running are vulnerable to the buffer overflow:

- BSDI 4.x default
- FreeBSD [2345].x default
- IRIX 6.5
- Linux netkit-telnetd version 0.14 and earlier
- NetBSD 1.x default
- OpenBSD 2.x
- Solaris 2.x sparc

TESO indicates that other vendor's telnet daemons have a high probability of being vulnerable as well. FreeBSD has confirmed the following releases are vulnerable:

"All releases of FreeBSD 3.x, 4.x prior to 4.4, FreeBSD 4.3-STABLE prior to the correction date."

Impact

An intruder can execute arbitrary code as the user running telnetd, typically root.

Solution

Install a patch from your vendor when available. Please continue to check this document for information available from the CERT/CC.

Disallow access to the telnet service (typically port 23/tcp) using firewall or packet-filtering technology. Blocking access to the telnet service will limit your exposure to attacks from outside your network perimeter. However, blocking port 23/tcp at a network perimeter would still allow any users, remote or local, within the perimeter of your network to exploit the vulnerability. It is important to understand your network's configuration and service requirements prior to deciding what changes are appropriate.

Vendor Information

745371

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

Apple Affected

BSDI Affected

Caldera Affected

Cisco Affected

Notified: July 24, 2001 Updated: February 01, 2002

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----

Cisco Security Advisory: Cisco CatOS Telnet Buffer Vulnerability ================================================================
Revision 1.0
For Public Release 2002 January 29 at 1500 UTC
- -------------------------------------------------------------------------------
Summary - ------- Some Cisco Catalyst switches, running certain CatOS based software releases, have a vulnerability wherein a buffer overflow in the telnet option handling can cause the telnet daemon to crash and result in a switch reload. This vulnerability can be exploited to initiate a denial of service (DoS) attack.
This vulnerability is documented as Cisco bug ID CSCdw19195. There are workarounds available to mitigate the vulnerability.
This advisory will be posted at http://www.cisco.com/warp/public/707/catos-telrcv-vuln-pub.shtml .
Affected Products - ----------------- Cisco's various Catalyst family of switches run CatOS-based releases or IOS-based releases. IOS-based releases are not vulnerable.
The following Cisco Catalyst Switches are vulnerable :
* Catalyst 6000 series * Catalyst 5000 series * Catalyst 4000 series * Catalyst 2948G * Catalyst 2900
For the switches above, the following CatOS based switch software revisions are vulnerable.
+-----------------------------------------------------------------------------+ | | Release 4 | Release 5 | Release 6 | Release 7 | | | code base | code base | code base | code base | |---------------+---------------+---------------+--------------+--------------| | Catalyst 6000 | Not | earlier than | earlier than | earlier than | | series | Applicable | 5.5(13) | 6.3(4) | 7.1(2) | |---------------+---------------+---------------+--------------+--------------| | Catalyst 5000 | earlier than | earlier than | earlier than | Not | | series | 4.5(13a) | 5.5(13) | 6.3(4) | Applicable | |---------------+---------------+---------------+--------------+--------------| | Catalyst 4000 | All releases | earlier than | earlier than | earlier than | | series | | 5.5(13) | 6.3(4) | 7.1(2) | +-----------------------------------------------------------------------------+
To determine your software revision, type show version at the command line prompt.
Not Affected Products - --------------------- The following Cisco Catalyst Switches are not vulnerable :
* Catalyst 8500 series * Catalyst 4800 series * Catalyst 4200 series * Catalyst 3900 series * Catalyst 3550 series * Catalyst 3500 XL series * Catalyst 4840G * Catalyst 4908G-l3 * Catalyst 2948G-l3 * Catalyst 2950 * Catalyst 2900 XL * Catalyst 2900 LRE XL * Catalyst 2820 * Catalyst 1900
No other Cisco product is currently known to be affected by this vulnerability.
Details - ------- Some Cisco Catalyst switches, running certain CatOS-based software releases, have a vulnerability wherein a buffer overflow in the telnet option handling can cause the telnet daemon to crash and result in a switch reload. This vulnerability can be exploited to initiate a denial of service (DoS) attack. Once the switch has reloaded, it is still vulnerable and the attack can be repeated as long as the switch is IP reachable on port 23 and has not been upgraded to a fixed version of CatOS switch software.
This vulnerability is documented as Cisco bug ID CSCdw19195, which requires a CCO account to view and can be viewed after 2002 January 30 at 1500 UTC.
Impact - ------ This vulnerability can be exploited to produce a denial of service (DoS) attack. When the vulnerability is exploited it can cause the Cisco Catalyst switch to crash and reload.
Software Versions and Fixes - --------------------------- This vulnerability has been fixed in the following switch software revisions and the fix will be carried forward in all future releases.
+-------------------------------------------------------------------------------+ | | Release 4 | Release 5 | Release 6 | Release 7 | | | code base | code base | code base | code base | |---------------+---------------+---------------+---------------+---------------| | Catalyst 6000 | Not | 5.5(13) and | 6.3(4) and | 7.1(2) and | | series | Applicable | later | later | later | |---------------+---------------+---------------+---------------+---------------| | Catalyst 5000 | 4.5(13a) | 5.5(13) and | 6.3(4) and | Not | | series | | later | later | Applicable | |---------------+---------------+---------------+---------------+---------------| | Catalyst 4000 | Not Available | 5.5(13) and | 6.3(4) and | 7.1(2) and | | series | | later | later | later | +-------------------------------------------------------------------------------+
All previous releases must upgrade to the above releases. CatOS switch software release 4.5(13a) for the Catalyst 5000 series is expected on CCO by 2002 February 4. CatOS switch software release 7.1(2) is expected on CCO by 2002 February 4.
Software upgrade can be performed via the console interface. Please refer to software release notes for instructions.
Obtaining Fixed Software - ------------------------ Cisco is offering free software upgrades to remedy this vulnerability for all affected customers. Customers with service contracts may upgrade to any software release containing the feature sets they have purchased.
Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's Worldwide Web site at http:// www.cisco.com .
Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge.
Customers who purchased directly from Cisco but who do not hold a Cisco service contract, and customers who purchase through third party vendors but are unsuccessful at obtaining fixed software through their point of sale, should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows:
* +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com
See http://www.cisco.com/warp/public/687/Directory.shtml for additional TAC contact information, including instructions and e-mail addresses for use in various languages.
Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non contract customers must be requested through the TAC.
Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.
Workarounds - ----------- The following workarounds can be implemented.
* If ssh is available in the code base use ssh instead of Telnet and disable Telnet.
For instructions how to do this please refer http://www.cisco.com/warp/ public/707/ssh_cat_switches.html
* Apply Access Control Lists (ACLs) on routers / switches / firewalls in front of the vulnerable switches such that traffic destined for the Telnet port 23 on the vulnerable switches is only allowed from the network management subnets.
For an example see http://www.cisco.com/univercd/cc/td/doc/product/lan/ cat6000/sw_5_4/msfc/acc_list.htm
Exploitation and Public Announcements - ------------------------------------- This vulnerability has been exploited to initiate Denial of Service (DoS) attacks.
This vulnerability was reported by TESO and is detailed at http://www.cert.org/advisories/CA-2001-21.html
Status of This Notice: Final - ---------------------------- This is a final notice. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this notice unless there is some material change in the facts. Should there be a significant change in the facts, Cisco may update this notice.
A standalone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
Distribution - ------------ This notice will be posted on Cisco's Worldwide Web site at http:// www.cisco.com/warp/public/707/catos-telrcv-vuln-pub.shtml .
In addition to Worldwide Web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients:
* cust-security-announce@cisco.com * bugtraq@securityfocus.com * firewalls@lists.gnac.com * first-teams@first.org (includes CERT/CC) * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * comp.dcom.sys.cisco * Various internal Cisco mailing lists
Future updates of this notice, if any, will be placed on Cisco's Worldwide Web server, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
Revision History - ---------------- +-----------------------------------------------------------------------------+ | Revision 1.0 | 2002-Jan-29 | For Public Release 2002 January 29 at 1500 UTC | +-----------------------------------------------------------------------------+
Cisco Security Procedures - ------------------------- Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's Worldwide Web site athttp://www.cisco.com/go/psirt . This includes instructions for press inquiries regarding Cisco security notices. - ------------------------------------------------------------------------------- This notice is copyright 2002 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information. - -------------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8 Comment: Signed by Sharad Ahlawat, Cisco Systems PSIRT
iQEVAwUBPFa4iw/VLJ+budTTAQGkywf9GkyUO77MFWJHqhGR+ZtNpk63NAzK4ath TGE/GyRJlht4YXvP4sTuKgRmsBkefXRoFttN0T8G1HytxTfFP75THbh5kk2kRFYo R4qcxM6QExs1FbJwx42MOjmD5Cyds8pdZ8ZSGdVTDe96k/0D+BNiN1oe672x1hkM 6Nrt1wnyRzKj7ZfF7NRnlN7DsR4gAPIIP0yLiP2KLJheqDnZNThANng97i9YP1Mz gve9jAwZtiKij6mv0LDG/Jkk/NUl5VijxfuoRFM4ZvAEn8hFYDLnvPJUVb+CvKpt 3AJ3/J+MBS8EAKTM98sGr5ywp7/cQfXWZsoJAYgHbGtEs3Qy6xbK+w== =1bxQ -----END PGP SIGNATURE-----.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Conectiva Affected

Cray Affected

Debian Affected

FreeBSD Affected

Hewlett Packard Affected

Notified: July 24, 2001 Updated: October 19, 2001

Status

Affected

Vendor Statement

----------------------------------------------------------------

HEWLETT-PACKARD COMPANY SECURITY BULLETIN: #0172
Originally issued: 16 October 2001
-----------------------------------------------------------------

The information in the following Security Bulletin should be acted
upon as soon as possible. Hewlett-Packard Company will not be
liable for any consequences to any customer resulting from customer's
failure to fully implement instructions in this Security Bulletin as
soon as possible.

------------------------------------------------------------------
PROBLEM: Systems running telnetd may permit unauthorized remote
access.
See: http://www.cert.org/advisories/CA-2001-21.html

This vulnerability has been assigned the identifier
CAN-2001-0554 by the Common Vulnerabilities and Exposures
(CVE) group:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0554

PLATFORM: HP9000 Servers running HP-UX releases 10.X only.

DAMAGE: An intruder can potentially execute arbitrary code
with the privileges of the telnetd process.

SOLUTION: Apply the following patches to the release specified.

10.01 PHNE_24820,
10.10 PHNE_24820,
10.20 PHNE_24821,
SIS 10.20 PHNE_24822 (Telnet kerberos Patch),
10.24 PHNE_25217.

MANUAL ACTIONS: The Secure Internet Services (SIS) product, if
enabled, has to be disabled before the installation
or removal of PHNE_24822 (Telnet kerberos Patch).

AVAILABILITY: The patches are available now from http://itrc.hp.com.

------------------------------------------------------------------
A. Background
A potential remotely exploitable buffer overflow in telnetd has
been reported to Hewlett-Packard Company. It is unique to HP-UX
releases 10.X only.

B. Fixing the problem
Disable telnetd (by commenting out the /etc/inetd.conf entry for
telnetd and running '/usr/sbin/inetd -c') if telentd is not needed
on your system.

Install the appropriate patch from the list below.

C. Recommended solution

Apply the following patches to the release specified.

10.01 PHNE_24820,
10.10 PHNE_24820,
10.20 PHNE_24821,
SIS 10.20 PHNE_24822,
10.24 PHNE_25217.

All patches are available now from http://itrc.hp.com.

D. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:

Use your browser to get to the HP IT Resource Center page
at:

http://itrc.hp.com

Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.

In the left most frame select "Maintenance and Support".

Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".

To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.

or

To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.

To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.

For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA"

The security patch matrix is also available via anonymous
ftp:

ftp.itrc.hp.com:~ftp/export/patches/hp-ux_patch_matrix

On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".

E. To report new security vulnerabilities, send email to

security-alert@hp.com

Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alert@hp.com.

Permission is granted for copying and circulating this
Bulletin to Hewlett-Packard (HP) customers (or the Internet
community) for the purpose of alerting them to problems,
if and only if, the Bulletin is not edited or changed in
any way, is attributed to HP, and provided such reproduction
and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
_____________________________________________________________

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

IBM Affected

MiT Kerberos Development Team Affected

Updated: August 09, 2001

Status

Affected

Vendor Statement

Please see http://web.mit.edu/kerberos/www/advisories/telnetd.txt

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE-----

KRB5 TELNETD BUFFER OVERFLOWS

2001-07-31

SUMMARY:

Buffer overflows exist in the telnet daemon included with MIT krb5.
Exploits are believed to exist for various operating systems on at
least the i386 architecture.

IMPACT:

If telnetd is running, a remote user may gain unauthorized root
access.

VULNERABLE DISTRIBUTIONS:

* MIT Kerberos 5, all releases to date.

FIXES:

The recommended approach is to apply the appropriate patches and to
rebuild your telnetd. Patches for the krb5-1.2.2 release may be found
at:

http://web.mit.edu/kerberos/www/advisories/telnetd_122_patch.txt

The associated detached PGP signature is at:

http://web.mit.edu/kerberos/www/advisories/telnetd_122_patch.txt.asc

These patches might apply successfully to older releases with some
amount of fuzz.

Please note that if you are using GNU make to build your krb5 sources,
the build system may attempt to rebuild the configure script from the
changed configure.in. This may cause trouble if you don't have
autoconf installed properly. To prevent this, you should use the
touch command or some similar means to ensure that the file
modification time on the configure script is newer than that of the
configure.in file.

If you are unable to patch your telnetd, you may should disable the
telnet service altogether.

This announcement and code patches related to it may be found on the
MIT Kerberos security advisory page at:

http://web.mit.edu/kerberos/www/advisories/index.html

The main MIT Kerberos web page is at:

http://web.mit.edu/kerberos/www/index.html

ACKNOWLEDGMENTS:

Thanks to TESO for the original alert / Bugtraq posting.

Thanks to Jeffrey Altman for assistance in developing these patches.

DETAILS:

A buffer overflow bug was discovered in telnet daemons derived from
BSD source code. Since the telnet daemon in MIT krb5 uses code
largely derived originally from BSD sources, it too is vulnerable.

By carefully constructing a series of telnet options to send to a
telnet server, a remote attacker may exercise a bug relating to lack
of bounds-checking, causing an overflow of a fixed-size buffer. This
overflow may possibly force the execution of malicious code.

It is not known how difficult this vulnerability is to exploit, since
the buffer is not on the stack. Some discussion seems to indicate
that exploits exist for this vulnerability that are believed to work
against various operating systems for i386-based machines. It is not
known whether these existing exploits have been successfully ported to
other processors.

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQCVAwUBO2cP4qbDgE/zdoE9AQEdhQQAsAxuzVwWu7pbtZ8ouNK7VAFrODGBHJ6R
AxizbvpPMEUAPmHtNqyC+J7hmdcumAxm4ro1dQ6qqZrpV8e8X+MykNoOkt7jbzqz
Q3KgfV8DkEthtoZ7M6asMrNScE6tBU6hfBAk33RU25vHMM42PRdRjliIDCCJl3pu
/slqReyHFTg=
=i6/X
-----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NetBSD Affected

OpenBSD Affected

RedHat Affected

SGI Affected

SuSE Affected

Sun Affected

Compaq Computer Corporation Not Affected

Notified: July 24, 2001 Updated: August 01, 2001

Status

Not Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________
SOURCE: Compaq Computer Corporation
Compaq Services
Software Security Response Team USA

Compaq case id SSRT0745U

ref: potential telnetd option handling vulnerability

x-ref: TESO Security Advisory 06/2001
CERT CA2001-21 Advisory 07/2001

Compaq has evaluated this vulnerability to telnetd
distributed for Compaq Tru64/UNIX and OpenVMS Operating
Systems Software and has determined that telnetd is not
vulnerable to unauthorized command execution or
root compromise.

Compaq appreciates your cooperation and patience.
We regret any inconvenience applying this information
may cause.

As always, Compaq urges you to periodically review your system
management and security procedures. Compaq will continue to
review and enhance the security features of its products and work
with customers to maintain and improve the security and integrity
of their systems.

To subscribe to automatically receive future NEW Security
Advisories from the Compaq's Software Security Response Team
via electronic mail,

Use your browser select the URL
http://www.support.compaq.com/patches/mailing-list.shtml
Select "Security and Individual Notices" for immediate dispatch
notifications directly to your mailbox.

To report new Security Vulnerabilities, send mail to:
security-ssrt@compaq.com

(c) Copyright 2001 Compaq Computer Corporation. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.1

iQA/AwUBO2C5JjnTu2ckvbFuEQKmqwCg/m87d9k22+qV5GY2vJAR409KFD4AoIbR
vsQaZ9DOI4D4sj5Feg4bRZmS
=F5Nq
-----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Secure Computing Corporation Not Affected

Data General Unknown

Fujitsu Unknown

Microsoft Unknown

NEC Unknown

Nokia Unknown

SCO Unknown

Sequent Unknown

Sony Unknown

Unisys Unknown

View all 28 vendors View less vendors

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

Acknowledgements

The CERT Coordination Center thanks TESO, who published an advisory on this issue. We would also like to thank Jeff Polk for technical assistance.

This document was written by Ian A. Finlay & Jason Rafail.

Other Information

CVE IDs:	CVE-2001-0554
CERT Advisory:	CA-2001-21
Severity Metric:	74.81
Date Public:	2001-07-18
Date First Published:	2001-07-24
Date Last Updated:	2002-04-16 19:36 UTC
Document Revision:	42

Software Engineering Institute

CERT Coordination Center

Multiple vendor telnet daemons vulnerable to buffer overflow via crafted protocol options

Vulnerability Note VU#745371

Overview

Description

Impact

Solution

Vendor Information

Apple Affected

BSDI Affected

Caldera Affected

Cisco Affected

Conectiva Affected

Cray Affected

Debian Affected

FreeBSD Affected

Hewlett Packard Affected

IBM Affected

MiT Kerberos Development Team Affected

NetBSD Affected

OpenBSD Affected

RedHat Affected

SGI Affected

SuSE Affected

Sun Affected

Compaq Computer Corporation Not Affected

Secure Computing Corporation Not Affected

Data General Unknown

Fujitsu Unknown

Microsoft Unknown

NEC Unknown

Nokia Unknown

SCO Unknown

Sequent Unknown

Sony Unknown

Unisys Unknown

CVSS Metrics