Vulnerability Note VU#995038

Debian Linux Netkit telnetd-ssl contains a format string vulnerability

Overview

Debian Linux Netkit telnetd-ssl contains a format string vulnerability that may allow a remote attacker to execute arbitrary code.

I. Description

An unspecified format string vulnerability in Debian Linux Netkit telnetd-ssl may allow a remote attacker to execute arbitrary code on a vulnerable system. According to public reports, exploitation occurs when telnetd-ssl attempts to process specially crafted SSL error messages. No further details are available at this time.

II. Impact

A remote attacker may be able to execute arbitrary code on a vulnerable system.

III. Solution

Upgrade

This problem has been addressed in Debian Linux version 0.17.17+0.1-2woody3 of the stable distribution (woody), and version 0.17.24+0.1-6 of the unstable distribution (sid). Please see the Debian Security Advisory DSA-616-1 for instructions on how to upgrade.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Debian GNU/Linux	Unknown	1-Feb-2005

References

http://secunia.com/advisories/13656/
http://www.debian.org/security/2004/dsa-616

Credit

This vulnerability was reported by Joel Eriksson.

This document was written by Jeff Gennari.

Other Information

Date Public:	2004-12-23
Date First Published:	2005-01-13
Date Last Updated:	2005-02-01
CERT Advisory:
CVE-ID(s):	CAN-2004-0998
NVD-ID(s):	CAN-2004-0998
US-CERT Technical Alerts:
Metric:	4.30
Document Revision:	58

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader