Buffer overflow in the slc_add_reply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character (SLC) commands.

Updated krb5 packages which fix two buffer overflow vulnerabilities in the included Kerberos-aware telnet client are now available.

Kerberos is a networked authentication system which uses a trusted third-party (a KDC) to authenticate clients and servers to each other.

The krb5-workstation package includes a Kerberos-aware telnet client.
Two buffer overflow flaws were discovered in the way the telnet client handles messages from a server. An attacker may be able to execute arbitrary code on a victim's machine if the victim can be tricked into connecting to a malicious telnet server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0468 and CVE-2005-0469 to these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

Updated krb5 packages which fix two buffer overflow vulnerabilities in the included Kerberos-aware telnet client are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a networked authentication system which uses a trusted third party (a KDC) to authenticate clients and servers to each other.

The krb5-workstation package includes a Kerberos-aware telnet client.
Two buffer overflow flaws were discovered in the way the telnet client handles messages from a server. An attacker may be able to execute arbitrary code on a victim's machine if the victim can be tricked into connecting to a malicious telnet server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0468 and CVE-2005-0469 to these issues.

Users of krb5 should update to these erratum packages which contain a backported patch to correct this issue.

Red Hat would like to thank iDEFENSE for their responsible disclosure of this issue.

A Project heimdal Security Advisory reports :

The telnet client program in Heimdal has buffer overflows in the functions slc_add_reply() and env_opt_add(), which may lead to remote code execution.

The telnetd server program in Heimdal has buffer overflows in the function getterminaltype, which may lead to remote code execution.

The rshd server in Heimdal has a privilege escalation bug when storing forwarded credentials. The code allowes a user to overwrite a file with its credential cache, and get ownership of the file.

Gael Delalleau discovered a buffer overflow in the env_opt_add() function of the Kerberos 4 and 5 telnet clients. By sending specially crafted replies, a malicious telnet server could exploit this to execute arbitrary code with the privileges of the user running the telnet client. (CVE-2005-0468)

Gael Delalleau discovered a buffer overflow in the handling of the LINEMODE suboptions in the telnet clients of Kerberos 4 and 5. By sending a specially constructed reply containing a large number of SLC (Set Local Character) commands, a remote attacker (i. e. a malicious telnet server) could execute arbitrary commands with the privileges of the user running the telnet client. (CVE-2005-0469)

Daniel Wachdorf discovered two remote vulnerabilities in the Key Distribution Center of Kerberos 5 (krb5-kdc). By sending certain TCP connection requests, a remote attacker could trigger a double-freeing of memory, which led to memory corruption and a crash of the KDC server. (CVE-2005-1174). Under rare circumstances the same type of TCP connection requests could also trigger a buffer overflow that could be exploited to run arbitrary code with the privileges of the KDC server.
(CVE-2005-1175)

Magnus Hagander discovered that the krb5_recvauth() function attempted to free previously freed memory in some situations. A remote attacker could possibly exploit this to run arbitrary code with the privileges of the program that called this function. Most imporantly, this affects the following daemons: kpropd (from the krb5-kdc package), klogind, and kshd (both from the krb5-rsh-server package).
(CVE-2005-1689)

Please note that these packages are not officially supported by Ubuntu (they are in the 'universe' component of the archive).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was discovered in the telnet client's handling of the LINEMODE suboptions. By sending a specially constructed reply containing a large number of SLC (Set Local Character) commands, a remote attacker (i. e. a malicious telnet server) could execute arbitrary commands with the privileges of the user running the telnet client. (CAN-2005-0469)

Michal Zalewski discovered a Denial of Service vulnerability in the telnet server (telnetd). A remote attacker could cause the telnetd process to free an invalid pointer, which caused the server process to crash, leading to a denial of service (inetd will disable the service if telnetd crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user). Please note that the telnet server is not officially supported by Ubuntu, it is in the 'universe' component.
(CAN-2004-0911).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New tcpip packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix a security issues with the telnet client.
Overflows in the telnet client may lead to the execution of arbitrary code as the telnet user if the user connects to a malicious telnet server.

Two buffer overflow flaws were discovered in the way the telnet client handles messages from a server. An attacker may be able to execute arbitrary code on a victim's machine if the victim can be tricked into connecting to a malicious telnet server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0468 and CVE-2005-0469 to these issues.

Red Hat would like to thank iDEFENSE for their responsible disclosure of this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gael Delalleau discovered a buffer overflow in the handling of the LINEMODE suboptions in telnet clients. Heimdal, a free implementation of Kerberos 5, also contains such a client. This can lead to the execution of arbitrary code when connected to a malicious server.

Several problems have been discovered in telnet clients that could be exploited by malicious daemons the client connects to. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-0468     Gael Delalleau discovered a buffer overflow in the     env_opt_add() function that allow a remote attacker to     execute arbitrary code.

  - CAN-2005-0469

    Gael Delalleau discovered a buffer overflow in the     handling of the LINEMODE suboptions in telnet clients.
    This can lead to the execution of arbitrary code when     connected to a malicious server.

The remote host is affected by the vulnerability described in GLSA-200504-28 (Heimdal: Buffer overflow vulnerabilities)

    Buffer overflow vulnerabilities in the slc_add_reply() and     env_opt_add() functions have been discovered by Gael Delalleau in the     telnet client in Heimdal.
  Impact :

    Successful exploitation would require a vulnerable user to connect     to an attacker-controlled host using the telnet client, potentially     executing arbitrary code with the permissions of the user running the     application.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200504-04 (mit-krb5: Multiple buffer overflows in telnet client)

    A buffer overflow has been identified in the env_opt_add()     function, where a response requiring excessive escaping can cause a     heap-based buffer overflow. Another issue has been identified in the     slc_add_reply() function, where a large number of SLC commands can     overflow a fixed size buffer.
  Impact :

    Successful exploitation would require a vulnerable user to connect     to an attacker-controlled telnet host, potentially executing arbitrary     code with the permissions of the telnet user on the client.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200504-01 (telnet-bsd: Multiple buffer overflows)

    A buffer overflow has been identified in the env_opt_add()     function of telnet-bsd, where a response requiring excessive escaping     can cause a heap-based buffer overflow. Another issue has been     identified in the slc_add_reply() function, where a large number of SLC     commands can overflow a fixed size buffer.
  Impact :

    Successful exploitation would require a vulnerable user to connect     to an attacker-controlled host using telnet, potentially executing     arbitrary code with the permissions of the telnet user.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200503-36 (netkit-telnetd: Buffer overflow)

    A buffer overflow has been identified in the slc_add_reply()     function of netkit-telnetd client, where a large number of SLC commands     can overflow a fixed size buffer.
  Impact :

    Successful exploitation would require a vulnerable user to connect     to an attacker-controlled host using telnet, potentially executing     arbitrary code with the permissions of the telnet user.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:330 advisory.

  - security flaw (CVE-2005-0468, CVE-2005-0469)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two buffer overflow issues were discovered in the way telnet clients handle messages from a server. Because of these issues, an attacker may be able to execute arbitrary code on the victim's machine if the victim can be tricked into connecting to a malicious telnet server.
The Kerberos package contains a telnet client and is patched to deal with these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:327 advisory.

  - security flaw (CVE-2005-0468, CVE-2005-0469)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Gael Delalleau discovered a buffer overflow in the handling of the LINEMODE suboptions in telnet clients. This can lead to the execution of arbitrary code when connected to a malicious server.

ID	Name	Product	Family	Severity
62255	Fedora Core 3 : krb5-1.3.6-5 (2005-270)	Nessus	Fedora Local Security Checks	high
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
21803	CentOS 3 : krb5 (CESA-2005:330)	Nessus	CentOS Local Security Checks	high
21499	FreeBSD : heimdal -- Multiple vulnerabilities (b62c80c2-b81a-11da-bec5-00123ffe8333)	Nessus	FreeBSD Local Security Checks	high
20767	Ubuntu 4.10 / 5.04 : krb4, krb5 vulnerabilities (USN-224-1)	Nessus	Ubuntu Local Security Checks	high
20487	Ubuntu 4.10 : netkit-telnet vulnerabilities (USN-101-1)	Nessus	Ubuntu Local Security Checks	high
19857	Slackware 10.0 / 10.1 / 8.1 / 9.0 / 9.1 / current : telnet client (SSA:2005-210-01)	Nessus	Slackware Local Security Checks	high
19642	Fedora Core 3 : telnet-0.17-32.FC3.2 (2005-274)	Nessus	Fedora Local Security Checks	high
19270	Debian DSA-765-1 : heimdal - buffer overflow	Nessus	Debian Local Security Checks	high
18518	Debian DSA-731-1 : krb4 - buffer overflows	Nessus	Debian Local Security Checks	high
18330	Fedora Core 2 : telnet-0.17-28.FC2.1 (2005-277)	Nessus	Fedora Local Security Checks	high
18327	Fedora Core 2 : krb5-1.3.6-4 (2005-269)	Nessus	Fedora Local Security Checks	high
18159	GLSA-200504-28 : Heimdal: Buffer overflow vulnerabilities	Nessus	Gentoo Local Security Checks	high
17978	GLSA-200504-04 : mit-krb5: Multiple buffer overflows in telnet client	Nessus	Gentoo Local Security Checks	high
17675	GLSA-200504-01 : telnet-bsd: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	high
17674	Debian DSA-703-1 : krb5 - buffer overflows	Nessus	Debian Local Security Checks	high
17666	GLSA-200503-36 : netkit-telnetd: Buffer overflow	Nessus	Gentoo Local Security Checks	high
17659	RHEL 4 : krb5 (RHSA-2005:330)	Nessus	Red Hat Local Security Checks	critical
17658	Mandrake Linux Security Advisory : krb5 (MDKSA-2005:061)	Nessus	Mandriva Local Security Checks	high
17645	RHEL 4 : telnet (RHSA-2005:327)	Nessus	Red Hat Local Security Checks	critical
17641	Debian DSA-699-1 : netkit-telnet-ssl - buffer overflow	Nessus	Debian Local Security Checks	high
17639	Debian DSA-697-1 : netkit-telnet - buffer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-0469

critical

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

critical

high

high