USN-101-1: telnet vulnerabilities

29 March 2005

netkit-telnet vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 4.10

Software Description

Details

A buffer overflow was discovered in the telnet client’s handling of the LINEMODE suboptions. By sending a specially constructed reply containing a large number of SLC (Set Local Character) commands, a remote attacker (i. e. a malicious telnet server) could execute arbitrary commands with the privileges of the user running the telnet client. (CAN-2005-0469)

Michal Zalewski discovered a Denial of Service vulnerability in the telnet server (telnetd). A remote attacker could cause the telnetd process to free an invalid pointer, which caused the server process to crash, leading to a denial of service (inetd will disable the service if telnetd crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the ‘telnetd’ user). Please note that the telnet server is not officially supported by Ubuntu, it is in the “universe” component. (CAN-2004-0911)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 4.10
telnet
telnetd

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

References