Bug 59563 (CVE-2001-0554) - VUL-0: CVE-2001-0554: telnet: Question about old telnet cert advisory
Summary: VUL-0: CVE-2001-0554: telnet: Question about old telnet cert advisory
Status: VERIFIED FIXED
Alias: CVE-2001-0554
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: S/390 Linux
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVE-2001-0554: CVSS v2 Base Score: 10...
Keywords:
Depends on:
Blocks: 42294
  Show dependency tree / graph
 
Reported: 2004-09-01 18:37 UTC by Thomas Saupe
Modified: 2021-09-26 10:28 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Saupe 2004-09-01 18:37:55 UTC 
Request from: mkprice@us.ibm.com 
 
--8<-- 
 
PRODUCT: SLES S/390 8 
( Please ignore if my previous attempt at creating this request succeeded ) .  
 
We have a customer who has recently purchased a network vulnerability tool 
from  
xforce.  When he runs this on his SLES8 SP3 system, he gets a warning that the  
system is suffering from the TelnetdOptionTelrcvBo problem.  
 
This keyword appears to be uniquely associated with CVE-2001-0554 ( CERT 
745371  
) - an old  buffer overflow issue with telnetd.  
 
The security advisory preceeds SLES8; and the patch for the problem appears in  
the version of telnet-server that the customer is running (  
telnet-server-1.0-140 ) .  
 
Furthermore, we cannot recreate CERT 745371 here in house.  
 
We are attempting to speak with xforce to find out why their product is  
producing this warning message; but because the customer is so anxious about  
this, I promised that I was enquire from SuSE if you are aware of any  
outstanding buffer overflow problems with the current version of 
telnet-server. 
 
-->8--
Comment 1 Thomas Saupe 2004-09-01 18:37:55 UTC 
<!-- SBZ_reproduce  -->
Not sure wheter we provide such information at all. 
But a statement would be appreciated.
Comment 2 Thomas Biege 2004-09-01 20:48:09 UTC 
Good old times. :) 
 
This bug was fixed by Thorsten 3 years ago when this issue came up: 
------------------------------------------------------------------- 
Tue Aug 14 13:54:53 CEST 2001 - kukuk@suse.de 
 
- Add more fixes for possible security problems 
 
------------------------------------------------------------------- 
Fri Jul 27 11:09:03 CEST 2001 - kukuk@suse.de 
 
- Add fix for possible problems with buffer overruns 
 
------------------------------------------------------------------- 
 
 
Maybe the scanner produces a "False Positive".
Comment 3 Thomas Saupe 2004-09-02 15:49:33 UTC 
Thanks, the customer is satisfied with this response. 
I will close the report.
Comment 4 Thomas Biege 2009-10-13 19:32:18 UTC 
CVE-2001-0554: CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)