Caldera Information for VU#745371
Multiple vendor telnet daemons vulnerable to buffer overflow via crafted protocol options
Caldera has determined that OpenServer, UnixWare 7 and OpenUnix 8 are vulnerable, and we are working on fixes. All of Caldera's Linux supported products are unaffected by this problem if all previously released security updates have been applied. If you're running either OpenLinux 2.3 or OpenLinux eServer 2.3, make sure you've updated your systems to netkit-telnet-0.16. This patch was released in March 2000, and are available from ftp://ftp.caldera.com
OpenLinux eServer 2.3.1:
OpenLinux eDesktop 2.4, OpenLinux 3.1 Server, and OpenLinux 3.1 Workstation are not affected.
The vendor has not provided us with any further information regarding this vulnerability.
Caldera has recently released CSSA-2001-030.0 which indicates that the following systems are indeed vulnerable:
All packages previous to netkit-telnet-0.17-12a on
- OpenLinux 2.3
- OpenLinux eServer 2.3.1 and OpenLinux eBuilder
- OpenLinux eDesktop 2.4
- OpenLinux Server 3.1
- OpenLinux Workstation 3.1
If you have feedback, comments, or additional information about this vulnerability, please send us email.