Software Engineering Institute

Notified:  July 24, 2001 Updated: October 04, 2001

Status

Affected

Vendor Statement

http://www.apple.com/support/security/security_updates.html

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  July 23, 2001 Updated: August 15, 2001

Status

Affected

Vendor Statement

All current versions of BSD/OS are vulnerable. Patches will be available via our web site at http://www.bsdi.com/services/support/patches and via ftp at ftp://ftp.bsdi.com/bsdi/support/patches as soon as testing has been completed.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  July 24, 2001 Updated: August 20, 2001

Status

Affected

Vendor Statement

Caldera has determined that OpenServer, UnixWare 7 and OpenUnix 8 are vulnerable, and we are working on fixes. All of Caldera's Linux supported products are unaffected by this problem if all previously released security updates have been applied. If you're running either OpenLinux 2.3 or OpenLinux eServer 2.3, make sure you've updated your systems to netkit-telnet-0.16. This patch was released in March 2000, and are available from ftp://ftp.caldera.com

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Caldera has recently released CSSA-2001-030.0 which indicates that the following systems are indeed vulnerable:

All packages previous to netkit-telnet-0.17-12a on

- OpenLinux 2.3
- OpenLinux eServer 2.3.1 and OpenLinux eBuilder
- OpenLinux eDesktop 2.4
- OpenLinux Server 3.1
- OpenLinux Workstation 3.1

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  July 24, 2001 Updated: February 01, 2002

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----

Cisco Security Advisory: Cisco CatOS Telnet Buffer Vulnerability
================================================================

Revision 1.0

For Public Release 2002 January 29 at 1500 UTC

- -------------------------------------------------------------------------------

Summary
- -------
Some Cisco Catalyst switches, running certain CatOS based software releases,
have a vulnerability wherein a buffer overflow in the telnet option handling
can cause the telnet daemon to crash and result in a switch reload. This
vulnerability can be exploited to initiate a denial of service (DoS) attack.

This vulnerability is documented as Cisco bug ID CSCdw19195. There are
workarounds available to mitigate the vulnerability.

This advisory will be posted at http://www.cisco.com/warp/public/707/
catos-telrcv-vuln-pub.shtml .

Affected Products
- -----------------
Cisco's various Catalyst family of switches run CatOS-based releases or
IOS-based releases. IOS-based releases are not vulnerable.

The following Cisco Catalyst Switches are vulnerable :

  * Catalyst 6000 series
 * Catalyst 5000 series
 * Catalyst 4000 series
 * Catalyst 2948G
 * Catalyst 2900

For the switches above, the following CatOS based switch software revisions are
vulnerable.

+-----------------------------------------------------------------------------+
|               |   Release 4   |   Release 5   |  Release 6   |  Release 7   |
|               |   code base   |   code base   |  code base   |  code base   |
|---------------+---------------+---------------+--------------+--------------|
| Catalyst 6000 |      Not      | earlier than  | earlier than | earlier than |
| series        |  Applicable   |    5.5(13)    |    6.3(4)    |    7.1(2)    |
|---------------+---------------+---------------+--------------+--------------|
| Catalyst 5000 | earlier than  | earlier than  | earlier than |     Not      |
| series        |   4.5(13a)    |    5.5(13)    |    6.3(4)    |  Applicable  |
|---------------+---------------+---------------+--------------+--------------|
| Catalyst 4000 | All releases  | earlier than  | earlier than | earlier than |
| series        |               |    5.5(13)    |    6.3(4)    |    7.1(2)    |
+-----------------------------------------------------------------------------+

To determine your software revision, type show version at the command line
prompt.

Not Affected Products
- ---------------------
The following Cisco Catalyst Switches are not vulnerable :

  * Catalyst 8500 series
 * Catalyst 4800 series
 * Catalyst 4200 series
 * Catalyst 3900 series
 * Catalyst 3550 series
 * Catalyst 3500 XL series
 * Catalyst 4840G
 * Catalyst 4908G-l3
 * Catalyst 2948G-l3
 * Catalyst 2950
 * Catalyst 2900 XL
 * Catalyst 2900 LRE XL
 * Catalyst 2820
 * Catalyst 1900

No other Cisco product is currently known to be affected by this vulnerability.

Details
- -------
Some Cisco Catalyst switches, running certain CatOS-based software releases,
have a vulnerability wherein a buffer overflow in the telnet option handling
can cause the telnet daemon to crash and result in a switch reload. This
vulnerability can be exploited to initiate a denial of service (DoS) attack.
Once the switch has reloaded, it is still vulnerable and the attack can be
repeated as long as the switch is IP reachable on port 23 and has not been
upgraded to a fixed version of CatOS switch software.

This vulnerability is documented as Cisco bug ID CSCdw19195, which requires a
CCO account to view and can be viewed after 2002 January 30 at 1500 UTC.

Impact
- ------
This vulnerability can be exploited to produce a denial of service (DoS)
attack. When the vulnerability is exploited it can cause the Cisco Catalyst
switch to crash and reload.

Software Versions and Fixes
- ---------------------------
This vulnerability has been fixed in the following switch software revisions
and the fix will be carried forward in all future releases.

+-------------------------------------------------------------------------------+
|               |   Release 4   |   Release 5   |   Release 6   |   Release 7   |
|               |   code base   |   code base   |   code base   |   code base   |
|---------------+---------------+---------------+---------------+---------------|
| Catalyst 6000 |      Not      |  5.5(13) and  |  6.3(4) and   |  7.1(2) and   |
| series        |  Applicable   |     later     |     later     |     later     |
|---------------+---------------+---------------+---------------+---------------|
| Catalyst 5000 |   4.5(13a)    |  5.5(13) and  |  6.3(4) and   |      Not      |
| series        |               |     later     |     later     |  Applicable   |
|---------------+---------------+---------------+---------------+---------------|
| Catalyst 4000 | Not Available |  5.5(13) and  |  6.3(4) and   |  7.1(2) and   |
| series        |               |     later     |     later     |     later     |
+-------------------------------------------------------------------------------+

All previous releases must upgrade to the above releases. CatOS switch software
release 4.5(13a) for the Catalyst 5000 series is expected on CCO by 2002
February 4. CatOS switch software release 7.1(2) is expected on CCO by 2002
February 4.

Software upgrade can be performed via the console interface. Please refer to
software release notes for instructions.

Obtaining Fixed Software
- ------------------------
Cisco is offering free software upgrades to remedy this vulnerability for all
affected customers. Customers with service contracts may upgrade to any
software release containing the feature sets they have purchased.

Customers with contracts should obtain upgraded software through their regular
update channels. For most customers, this means that upgrades should be
obtained through the Software Center on Cisco's Worldwide Web site at http://
www.cisco.com .

Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with the upgrade, which should be free of
charge.

Customers who purchased directly from Cisco but who do not hold a Cisco service
contract, and customers who purchase through third party vendors but are
unsuccessful at obtaining fixed software through their point of sale, should
get their upgrades by contacting the Cisco Technical Assistance Center (TAC).
TAC contacts are as follows:

  * +1 800 553 2447 (toll free from within North America)
 * +1 408 526 7209 (toll call from anywhere in the world)
 * e-mail: tac@cisco.com

See http://www.cisco.com/warp/public/687/Directory.shtml for additional TAC
contact information, including instructions and e-mail addresses for use in
various languages.

Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades for non
contract customers must be requested through the TAC.

Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com"
for software upgrades.

Workarounds
- -----------
The following workarounds can be implemented.

  * If ssh is available in the code base use ssh instead of Telnet and disable
   Telnet.

    For instructions how to do this please refer http://www.cisco.com/warp/
   public/707/ssh_cat_switches.html

  * Apply Access Control Lists (ACLs) on routers / switches / firewalls in
   front of the vulnerable switches such that traffic destined for the Telnet
   port 23 on the vulnerable switches is only allowed from the network
   management subnets.

    For an example see http://www.cisco.com/univercd/cc/td/doc/product/lan/
   cat6000/sw_5_4/msfc/acc_list.htm

Exploitation and Public Announcements
- -------------------------------------
This vulnerability has been exploited to initiate Denial of Service (DoS)
attacks.

This vulnerability was reported by TESO and is detailed at http://www.cert.org/
advisories/CA-2001-21.html

Status of This Notice: Final
- ----------------------------
This is a final notice. Although Cisco cannot guarantee the accuracy of all
statements in this notice, all of the facts have been checked to the best of
our ability. Cisco does not anticipate issuing updated versions of this notice
unless there is some material change in the facts. Should there be a
significant change in the facts, Cisco may update this notice.

A standalone copy or paraphrase of the text of this security advisory that
omits the distribution URL in the following section is an uncontrolled copy,
and may lack important information or contain factual errors.

Distribution
- ------------
This notice will be posted on Cisco's Worldwide Web site at http://
www.cisco.com/warp/public/707/catos-telrcv-vuln-pub.shtml .

In addition to Worldwide Web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail
and Usenet news recipients:

  * cust-security-announce@cisco.com
 * bugtraq@securityfocus.com
 * firewalls@lists.gnac.com
 * first-teams@first.org (includes CERT/CC)
 * cisco@spot.colorado.edu
 * cisco-nsp@puck.nether.net
 * comp.dcom.sys.cisco
 * Various internal Cisco mailing lists

Future updates of this notice, if any, will be placed on Cisco's Worldwide Web
server, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
above URL for any updates.

Revision History
- ----------------
+-----------------------------------------------------------------------------+
| Revision 1.0 | 2002-Jan-29 | For Public Release 2002 January 29 at 1500 UTC |
+-----------------------------------------------------------------------------+

Cisco Security Procedures
- -------------------------
Complete information on reporting security vulnerabilities in Cisco products,
obtaining assistance with security incidents, and registering to receive
security information from Cisco, is available on Cisco's Worldwide Web site at
http://www.cisco.com/go/psirt . This includes instructions for press inquiries
regarding Cisco security notices.
- -------------------------------------------------------------------------------
This notice is copyright 2002 by Cisco Systems, Inc. This notice may be
redistributed freely after the release date given at the top of the text,
provided that redistributed copies are complete and unmodified, including all
date and version information.
- -------------------------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Signed by Sharad Ahlawat, Cisco Systems PSIRT

iQEVAwUBPFa4iw/VLJ+budTTAQGkywf9GkyUO77MFWJHqhGR+ZtNpk63NAzK4ath
TGE/GyRJlht4YXvP4sTuKgRmsBkefXRoFttN0T8G1HytxTfFP75THbh5kk2kRFYo
R4qcxM6QExs1FbJwx42MOjmD5Cyds8pdZ8ZSGdVTDe96k/0D+BNiN1oe672x1hkM
6Nrt1wnyRzKj7ZfF7NRnlN7DsR4gAPIIP0yLiP2KLJheqDnZNThANng97i9YP1Mz
gve9jAwZtiKij6mv0LDG/Jkk/NUl5VijxfuoRFM4ZvAEn8hFYDLnvPJUVb+CvKpt
3AJ3/J+MBS8EAKTM98sGr5ywp7/cQfXWZsoJAYgHbGtEs3Qy6xbK+w==
=1bxQ
-----END PGP SIGNATURE-----.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Updated:  August 27, 2001

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE   : telnet
SUMMARY   : Remote root vulnerability
DATE      : 2001-08-24 15:43:00
ID        : CLA-2001:413
RELEVANT
RELEASES  : 4.0, 4.0es, 4.1, 4.2, 5.0, prg graficos, ecommerce, 5.1, 6.0, 7.0

- -------------------------------------------------------------------------

DESCRIPTION
The TESO crew reported on Bugtraq a vulnerability affecting the
telnet server which can be used by remote attackers to obtain root
privileges. Initially it was thought that the netkit-telnet package,
used by most linux distributions, was not vulnerable starting with
version 0.14, but zen-parse showed later on that those versions,
including the 0.17 one, are also vulnerable.


SOLUTION
We recommend that all users currently using telnet start using
openssh instead or some other form of encrypted communication.
Users who cannot switch to openssh now should upgrade the telnet
package immediately. Please note that no restart is necessary after
the upgrade, since telnet is started on demand by inetd.


 REFERENCES:
1. http://www.securityfocus.com/bid/3064


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/4.0/SRPMS/telnet-0.17-1U40_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/4.0/i386/telnet-0.17-1U40_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.0es/SRPMS/telnet-0.17-1U40_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/4.0es/i386/telnet-0.17-1U40_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.1/SRPMS/telnet-0.17-1U41_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/4.1/i386/telnet-0.17-1U41_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/4.2/SRPMS/telnet-0.17-1U42_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/4.2/i386/telnet-0.17-1U42_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/telnet-0.17-1U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/telnet-0.17-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/telnet-server-0.17-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/telnet-0.17-1U51_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/telnet-server-0.17-1U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/telnet-0.17-1U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/telnet-0.17-2U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/telnet-server-0.17-2U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/telnet-0.17-2U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/telnet-0.17-2U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/telnet-0.17-2U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/telnet-server-0.17-2U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/SRPMS/telnet-0.17-1U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/telnet-0.17-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/telnet-server-0.17-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/SRPMS/telnet-0.17-1U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/telnet-0.17-1U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/telnet-server-0.17-1U50_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to perform
upgrades of RPM packages:
- add the following line to /etc/apt/sources.list if it is not there yet
  (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running CL6.0)

 - run:                 apt-get update
- after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7hqHX42jd0JmAcZARAq2tAKDTiE4tzCaFXf8ZCGMLNCE1m+PUfwCg2hpZ
vPyXIWcdPbi77u2qfgBpUDc=
=DWFX
-----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Updated:  September 07, 2001

Status

Affected

Vendor Statement

Cray, Inc. has found UNICOS and UNICOS/mk to be vulnerable. Please see Field Notice 5062 and spr 720789 for fix information. We are currently investigating the MTA for vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  July 24, 2001 Updated: August 21, 2001

Status

Affected

Vendor Statement

All released versions of FreeBSD are vulnerable to this problem, which was fixed in FreeBSD 4.3-STABLE and FreeBSD 3.5.1-STABLE on July 23, 2001. An advisory has been released, along with a patch to correct the vulnerability and a binary upgrade package suitable for use on FreeBSD 4.3-RELEASE systems. For more information, see the advisory at the following location:

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:49.telnetd.asc

or use an FTP mirror site from the following URL:

http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mirrors-ftp.html

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

FreeBSD has also released ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01%3A54.ports-telnetd.asc, a follow up advisory releated to third party implementations found in FreeBSD ports collection.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  July 24, 2001 Updated: October 19, 2001

Status

Affected

Vendor Statement

----------------------------------------------------------------

HEWLETT-PACKARD COMPANY SECURITY BULLETIN: #0172
Originally issued: 16 October 2001
-----------------------------------------------------------------

The information in the following Security Bulletin should be acted
upon as soon as possible. Hewlett-Packard Company will not be
liable for any consequences to any customer resulting from customer's
failure to fully implement instructions in this Security Bulletin as
soon as possible.

------------------------------------------------------------------
PROBLEM: Systems running telnetd may permit unauthorized remote
access.
See: http://www.cert.org/advisories/CA-2001-21.html

This vulnerability has been assigned the identifier
CAN-2001-0554 by the Common Vulnerabilities and Exposures
(CVE) group:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0554


PLATFORM: HP9000 Servers running HP-UX releases 10.X only.

DAMAGE: An intruder can potentially execute arbitrary code
with the privileges of the telnetd process.

SOLUTION: Apply the following patches to the release specified.

10.01 PHNE_24820,
10.10 PHNE_24820,
10.20 PHNE_24821,
SIS 10.20 PHNE_24822 (Telnet kerberos Patch),
10.24 PHNE_25217.

MANUAL ACTIONS: The Secure Internet Services (SIS) product, if
enabled, has to be disabled before the installation
or removal of PHNE_24822 (Telnet kerberos Patch).

AVAILABILITY: The patches are available now from http://itrc.hp.com.

------------------------------------------------------------------
A. Background
A potential remotely exploitable buffer overflow in telnetd has
been reported to Hewlett-Packard Company. It is unique to HP-UX
releases 10.X only.

B. Fixing the problem
Disable telnetd (by commenting out the /etc/inetd.conf entry for
telnetd and running '/usr/sbin/inetd -c') if telentd is not needed
on your system.

Install the appropriate patch from the list below.

C. Recommended solution

Apply the following patches to the release specified.

10.01 PHNE_24820,
10.10 PHNE_24820,
10.20 PHNE_24821,
SIS 10.20 PHNE_24822,
10.24 PHNE_25217.

All patches are available now from http://itrc.hp.com.

D. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:

Use your browser to get to the HP IT Resource Center page
at:

http://itrc.hp.com

Use the 'Login' tab at the left side of the screen to login
using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the
User ID assigned to you, and your password.

In the left most frame select "Maintenance and Support".

Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".

To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.

or

To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.

To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive". (near the
bottom of the page) Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic. Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.

For information on the Security Patch Check tool, see:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA"

The security patch matrix is also available via anonymous
ftp:

ftp.itrc.hp.com:~ftp/export/patches/hp-ux_patch_matrix

On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".


E. To report new security vulnerabilities, send email to

security-alert@hp.com

Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alert@hp.com.

Permission is granted for copying and circulating this
Bulletin to Hewlett-Packard (HP) customers (or the Internet
community) for the purpose of alerting them to problems,
if and only if, the Bulletin is not edited or changed in
any way, is attributed to HP, and provided such reproduction
and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. HP is not
liable for any misuse of this information by any third party.
_____________________________________________________________

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  July 24, 2001 Updated: August 10, 2001

Status

Affected

Vendor Statement

IBM's AIX operating system, versions 5.1L and under, is vulnerable to this exploit.

An emergency fix (efix) is now available for downloading from the ftp site ftp://aix.software.ibm.com/aix/efixes/security. The efix package name to fix this vulnerability is "telnetd_efix.tar.Z". An advisory is included in the tarfile that gives installation instructions for the appropriate patched telnetd binary. Two patches are in the tarfile: one for AIX 4.3.3 (telnetd.433) and for AIX 5.1 (telnetd.510).

IBM has these APAR assignments for this vulnerability: For AIX 4.3.3, the APAR number is IY22029. For AIX 5.1, the APAR number is IY22021.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.