Caldera Information for VU#745371
Multiple vendor telnet daemons vulnerable to buffer overflow via crafted protocol options
- Vendor Information Help Date Notified: 24 Jul 2001
- Statement Date:
- Date Updated: 20 Aug 2001
Status
Affected
Vendor Statement
Caldera has determined that OpenServer, UnixWare 7 and OpenUnix 8 are vulnerable, and we are working on fixes. All of Caldera's Linux supported products are unaffected by this problem if all previously released security updates have been applied. If you're running either OpenLinux 2.3 or OpenLinux eServer 2.3, make sure you've updated your systems to netkit-telnet-0.16. This patch was released in March 2000, and are available from ftp://ftp.caldera.com
OpenLinux 2.3: /pub/openlinux/updates/2.3/022/RPMS/netkit-telnet-0.16-1.i386.rpm OpenLinux eServer 2.3.1: /pub/eServer/2.3/updates/2.3/007/RPMS/netkit-telnet-0.16-1.i386.rpm OpenLinux eDesktop 2.4, OpenLinux 3.1 Server, and OpenLinux 3.1 Workstation are not affected. |
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Vendor References
None
Addendum
Caldera has recently released CSSA-2001-030.0 which indicates that the following systems are indeed vulnerable:
All packages previous to netkit-telnet-0.17-12a on
- OpenLinux 2.3
- OpenLinux eServer 2.3.1 and OpenLinux eBuilder
- OpenLinux eDesktop 2.4
- OpenLinux Server 3.1
- OpenLinux Workstation 3.1
If you have feedback, comments, or additional information about this vulnerability, please send us email.