Vulnerability Note VU#569272

Implementations of login, derived from System V, use a fixed-size buffer to store environment and argument variables that are received from other programs. This buffer can be overflowed by inputing numerous variables. An attacker can use this vulnerability to gain the privileges of the process that invoked login. If an attacker with a local shell invokes login directly, they can only gain the privileges of the shell they already have. However, if the attacker can invoke login via a suid root program, such as the in.telnetd or in.rlogind daemons, they can gain the privileges of the invoking suid program, typically root. And of course, because in.telnetd and in.rlogind are available over the network, an attacker without any previous access to the system could use this vulnerability to gain root access directly.

An exploit exists and may be circulating.

A remote intruder can gain a root shell.

Apply a patch when one becomes available. If patches are not available for your version, upgrade to a supported version and apply all patches.

Disable telnet, rlogin, and other programs that use login for authentication. Use programs that use SSH instead and do not use login by default.