Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.

The remote host is affected by the vulnerability described in GLSA-200410-03 (NetKit-telnetd: buffer overflows in telnet and telnetd)

    A possible buffer overflow exists in the parsing of option strings by the     telnet daemon, where proper bounds checking is not applied when writing to     a buffer. Additionaly, another possible buffer overflow has been found by     Josh Martin in the handling of the environment variable HOME.
  Impact :

    A remote attacker sending a specially crafted options string to the telnet     daemon could be able to run arbitrary code with the privileges of the user     running the telnet daemon, usually root. Furthermore, an attacker could     make use of an overlong HOME variable to cause a buffer overflow in the     telnet client, potentially leading to the local execution of arbitrary     code.
  Workaround :

    There is no known workaround at this time.

The telnet daemon contained in the netkit-telnet-ssl_0.16.3-1 package  in the 'stable' (potato) distribution of Debian GNU/Linux is  vulnerable to an exploitable overflow in its output handling. The  original bug was found by <scut@nb.in-berlin.de>, and announced to  bugtraq on Jul 18 2001. At that time, netkit-telnet versions after  0.14 were not believed to be vulnerable.

On Aug 10 2001, zen-parse posted an advisory based on the same problem, for all netkit-telnet versions below 0.17.

More details can be found on SecurityFocus. As Debian uses the 'telnetd' user to run in.telnetd, this is not a remote root compromise on Debian systems; the 'telnetd' user can be compromised.

We strongly advise you update your netkit-telnet-ssl packages to the versions listed below.

The netkit-telnet daemon contained in the telnetd package version  0.16-4potato1, which is shipped with the 'stable' (2.2, potato)  distribution of Debian GNU/Linux, is vulnerable to an exploitable  overflow in its output handling.

The original bug was found by <scut@nb.in-berlin.de>, and announced to bugtraq on Jul 18 2001. At that time, netkit-telnet versions after 0.14 were not believed to be vulnerable.

On Aug 10 2001, zen-parse posted an advisory based on the same problem, for all netkit-telnet versions below 0.17.

More details can be found on http://online.securityfocus.com/archive/1/203000. As Debian uses the `telnetd' user to run in.telnetd, this is not a remote root compromise on Debian systems; however, the user `telnetd' can be compromised.

We strongly advise you update your telnetd package to the versions listed below.

A buffer overflow exists in the telnet portion of Kerberos that could provide root access to local users. MDKSA-2001:068 provided a similar fix to the normal telnet packages, but the Kerberized equivalent was not updated previously.

A buffer overflow exists in telnet which could provide root access to local users.

Some Cisco Catalyst switches, running certain CatOS based software releases, have a vulnerability wherein a buffer overflow in the telnet option handling can cause the telnet daemon to crash and result in a switch reload. This vulnerability can be exploited to initiate a denial of service (DoS) attack.

This vulnerability is documented as Cisco bug ID CSCdw19195.

The Telnet server does not return an expected number of replies when it receives a long sequence of 'Are You There' commands.  This probably means it overflows one of its internal buffers and crashes. This could likely lead to arbitrary code execution.

ID	Name	Product	Family	Severity
15424	GLSA-200410-03 : NetKit-telnetd: buffer overflows in telnet and telnetd	Nessus	Gentoo Local Security Checks	critical
14912	Debian DSA-075-1 : netkit-telnet-ssl - remote exploit	Nessus	Debian Local Security Checks	critical
14907	Debian DSA-070-1 : netkit-telnet - remote exploit	Nessus	Debian Local Security Checks	critical
13906	Mandrake Linux Security Advisory : krb5 (MDKSA-2001:093)	Nessus	Mandriva Local Security Checks	critical
13883	Mandrake Linux Security Advisory : telnet (MDKSA-2001:068)	Nessus	Mandriva Local Security Checks	critical
10986	Cisco CatOS Telnet Option Handling Overflow (CSCdw19195)	Nessus	CISCO	critical
10709	BSD Based telnetd telrcv Function Remote Command Execution	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2001-0554

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical