CERT Advisory CA-2001-21 Buffer Overflow in telnetd

• Systems running versions of telnetd derived from BSD source.

Overview

I. Description

There is a remotely exploitable buffer overflow in Telnet daemons derived from BSD source code. During the processing of the Telnet protocol options, the results of the "telrcv" function are stored in a fixed-size buffer. It is assumed that the results are smaller than the buffer and no bounds checking is performed.

The vulnerability was discovered by TESO. An exploit for this vulnerability has been publicly released; internal testing at CERT/CC confirms this exploit works against at least one target system. For more information, see

II. Impact

An intruder can execute arbitrary code with the privileges of the telnetd process, typically root.

III. Solution

Apply a patch

Appendix A. - Vendor Information

This appendix contains information provided by vendors for this advisory. When vendors report new information to the CERT/CC, we update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments.

Cisco Systems

Compaq Computer Corporation

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________
SOURCE: Compaq Computer Corporation
        Compaq Services
        Software Security Response Team USA

Compaq case id SSRT0745U

ref:   potential telnetd option handling vulnerability

x-ref: TESO Security Advisory   06/2001
       CERT CA2001-21 Advisory  07/2001


 Compaq has evaluated this vulnerability to telnetd
 distributed for Compaq Tru64/UNIX and OpenVMS Operating
 Systems Software and has determined that telnetd is not
 vulnerable to unauthorized command execution or
 root compromise.

 Compaq appreciates your cooperation and patience.
 We regret any inconvenience applying this information
 may cause.

 As always, Compaq urges you to periodically review your system
 management and security procedures.  Compaq will continue to
 review and enhance the security features of its products and work
 with customers to maintain and improve the security and integrity
 of their systems.

 To subscribe to automatically receive future NEW Security
 Advisories from the Compaq's Software Security Response Team
 via electronic mail,

 Use your browser select the URL
  http://www.support.compaq.com/patches/mailing-list.shtml
  Select "Security and Individual Notices" for immediate dispatch
  notifications directly to your mailbox.

  To report new Security Vulnerabilities, send mail to:
     security-ssrt@compaq.com

(c) Copyright 2001 Compaq Computer Corporation. All rights reserved.


-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.1

iQA/AwUBO2C5JjnTu2ckvbFuEQKmqwCg/m87d9k22+qV5GY2vJAR409KFD4AoIbR
vsQaZ9DOI4D4sj5Feg4bRZmS
=F5Nq
-----END PGP SIGNATURE-----

Conectiva

Cray, Inc.

Cray, Inc. has found UNICOS and UNICOS/mk to be vulnerable. Please see Field Notice 5062 and spr 720789 for fix information. We are currently investigating the MTA for vulnerability.

FreeBSD, Inc.

Hewlett-Packard Company

...HP-UX 11.X is not vulnerable, HP_UX 10.X is vulnerable. Patches are in process, watch for the associated HP security Bulletin....

IBM Corporation

IBM's AIX operating system, versions 5.1L and under, is vulnerable to this exploit. IBM has these APAR assignments for this vulnerability: For AIX 4.3.3, the APAR number is IY22029. For AIX 5.1, the APAR number is IY22021.

NetBSD

All releases of NetBSD are affected. The issue was patched in NetBSD-current on July 19th. A Security Advisory including patches will be available shortly, at:

Secure Computing Corporation

The telnetd vulnerability referenced is not applicable to Sidewinder as a result of disciplined security software design practices in combination with Secure Computing's patented Type Enforcement(tm) technology. Sidewinder's telnetd services are greatly restricted due to both known and theoretical vulnerabilities. This least privilege design renders the attack described in the CERT-2001-21 Advisory useless. In addition, Sidewinder's operating system, SecureOS(tm), built on Secure's Type Enforcement technology, has further defenses against this attack that would trigger multiple security violations.

Specifically, the attack first attempts to start a shell process. Sidewinder's embedded Type Enforcement security rules prevent telnetd from replicating itself and accessing the system shell programs. Even without this embedded, tamper proof rule in place, other Type Enforcement rules also defend against this attack. As an example, the new shell would need administrative privileges and those privileges are not available to the telnetd services.

SGI

SGI acknowledges the telnetd vulnerability reported by CERT and is currently investigating. Until SGI has more definitive information to provide, customers are encouraged to assume all security vulnerabilities as exploitable and take appropriate steps according to local site security policies and requirements.

As further information becomes available, additional advisories will be issued via the normal SGI security information distribution methods including the wiretap mailing list and

A buffer overflow has been discovered in in.telnetd which allows a local or a remote attacker to kill the in.telnetd daemon on the affected SunOS system. Sun does not believe that this issue can be exploited on SunOS systems to gain elevated privileges. As there was a buffer overflow, Sun has generated patches for this issue. The patches are described in the following SunAlert:

Appendix B. - References