Vulnerability Note VU#341908

Multiple Telnet Clients vulnerable to buffer overflow via the env_opt_add() function in telnet.c

Overview

Multiple Telnet clients contain a data length validation flaw that may allow a malicious server to execute arbitrary code on the client host with privs of client.

I. Description

The Telnet network protocol is described in RFC854 and RFC855 as a general, bi-directional communications facility. The Telnet protocol is commonly used for command-line login sessions between Internet hosts.

Many Telnet clients are vulnerable to a buffer overflow condition.

The env_opt_add() function of telnet.c contains a 256-byte buffer that may be expanded to 512 bytes if needed. While checks are in place to ensure that the input buffer for this function is within the size allocated, the Telnet protocol may escape characters contained in the input buffer. If the number of characters escaped causes the resulting input to exceed the 512 byte allocated buffer, a heap overflow occurs.

Several Telnet clients derived from a variety of lineages are confirmed to be affected. Please review the "Systems Affected" section below, or consult with your vendor to determine if you are affected.

II. Impact

Exploitation of this vulnerability may permit a malicious server to execute arbitrary code with the privileges of the user that invoked the telnet client. An attacker would have to trick a victim into initiating a telnet connection using a vulnerable client. This may be accomplished with an HTML rendered email or web page, using the TELNET:// URI handler, however further user interaction may be required.

III. Solution

Apply a patch or upgrade as specified by your vendor.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Vulnerable	1-Apr-2005
Conectiva	Vulnerable	6-Jun-2005
Cray Inc.	Unknown	30-Mar-2005
Debian	Vulnerable	4-Apr-2005
EMC Corporation	Unknown	30-Mar-2005
Engarde	Unknown	30-Mar-2005
F5 Networks	Vulnerable	3-May-2005
Fedora Project	Vulnerable	4-Apr-2005
FreeBSD	Vulnerable	30-Mar-2005
Fujitsu	Unknown	30-Mar-2005
Gentoo Linux	Vulnerable	1-Apr-2005
Heimdal	Vulnerable	21-Apr-2005
Hewlett-Packard Company	Unknown	30-Mar-2005
Hitachi	Unknown	30-Mar-2005
IBM	Unknown	30-Mar-2005
IBM eServer	Unknown	30-Mar-2005
IBM zSeries	Unknown	30-Mar-2005
Immunix	Unknown	30-Mar-2005
Ingrian Networks	Unknown	30-Mar-2005
Juniper Networks	Unknown	30-Mar-2005
MandrakeSoft	Vulnerable	7-Apr-2005
Microsoft Corporation	Not Vulnerable	1-Apr-2005
MIT Kerberos Development Team	Vulnerable	30-Mar-2005
MontaVista Software	Unknown	30-Mar-2005
NEC Corporation	Unknown	30-Mar-2005
NetBSD	Unknown	30-Mar-2005
Nokia	Unknown	30-Mar-2005
Novell	Unknown	30-Mar-2005
OpenBSD	Vulnerable	7-Apr-2005
Openwall GNU/*/Linux	Vulnerable	30-Mar-2005
Red Hat Inc.	Vulnerable	28-Jul-2005
SCO Linux	Unknown	30-Mar-2005
SCO Unix	Vulnerable	14-Apr-2005
Sequent	Unknown	30-Mar-2005
SGI	Vulnerable	27-Apr-2005
Sony Corporation	Unknown	30-Mar-2005
Sun Microsystems Inc.	Vulnerable	14-Apr-2005
SuSE Inc.	Unknown	30-Mar-2005
TurboLinux	Unknown	30-Mar-2005
Unisys	Unknown	30-Mar-2005
WRS	Unknown	30-Mar-2005

References

http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities
http://secunia.com/advisories/14745/
http://web.mit.edu/kerberos/www/...s/MITKRB5-SA-2005-001-telnet.txt
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57755-1
http://www.auscert.org.au/5134

Credit

Thanks to iDEFENSE Labs for reporting this vulnerability.

This document was written by Robert Mead and Jason Rafail, and is based on information in iDefense's advisory.

Other Information

Date Public:	2005-03-28
Date First Published:	2005-04-01
Date Last Updated:	2005-07-28
CERT Advisory:
CVE-ID(s):	CAN-2005-0468
NVD-ID(s):	CAN-2005-0468
US-CERT Technical Alerts:
Severity Metric:	29.95
Document Revision:	28

If you have feedback, comments, or additional information about this vulnerability, please send us email.