#101665: Buffer Overflow in telnet(1) Client Software (formerly Document ID: 57755)

Sun(sm) Alert Notification

Sun Alert ID: 101665 (formerly 57755)
Synopsis: Buffer Overflow in telnet(1) Client Software
Category: Security
Product: Solaris 9 Operating System, Solaris 10 Operating System, Solaris 7 Operating System, Solaris 8 Operating System
BugIDs: 6234932
Avoidance: Patch, Workaround
State: Resolved
Date Released: 28-Mar-2005, 29-Mar-2005, 14-Jun-2005
Date Closed: 29-Mar-2005
Date Modified: 29-Mar-2005, 13-Jun-2005

1. Impact

There is a buffer overflow in the unprivileged telnet(1) utility. This is not a security vulnerability on its own. However, telnet(1) communicates with another host using the TELNET protocol and thus there is a small risk of a remote user successfully exploiting the overflow.

If a remote unprivileged user is able to cause a user to execute the telnet(1) utility on their client system, then that remote user may be able to execute arbitrary commands on the client system with the privileges of the user who executed telnet(1). The remote user may also be able to read the values of arbitrary shell environment variables of the user who executed telnet(1).

Sun acknowledges with thanks, iDEFENSE (http://www.idefense.com), for bringing these issues to our attention. These issues are also referenced in the following iDEFENSE documents:

IDEF0865 - Multiple Vendor Telnet Client Information Disclosure Vulnerability at http://www.idefense.com/application/poi/display?id=260

IDEF0866 - Multiple Telnet Client slc_add_reply() Buffer Overflow at http://www.idefense.com/application/poi/display?id=220

IDEF0867 - Multiple Telnet Client env_opt_add() Buffer Overflow at http://www.idefense.com/application/poi/display?id=221

These issues are also described in the following CAN documents:

CAN-2005-0468 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0468

CAN-2005-0469 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0469

CAN-2005-0488 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0488

These issues are also described in the following CERT Vulnerability Notes:

VU#291924 at http://www.kb.cert.org/vuls/id/291924

VU#341908 at http://www.kb.cert.org/vuls/id/341908

VU#800829 at http://www.kb.cert.org/vuls/id/800829

2. Contributing Factors

These issues can occur in the following releases:

SPARC Platform

Solaris 7 without patch 119519-01
Solaris 8 without patch 110668-05
Solaris 9 without patch 119433-01
Solaris 10 without patch 118560-01

x86 Platform

Solaris 7 without patch 119520-01
Solaris 8 without patch 110669-05
Solaris 9 without patch 119434-01
Solaris 10 without patch 118561-01

3. Symptoms

There are no predictable symptoms that would indicate the described issues have been exploited.

Solution Summary

Top

4. Relief/Workaround

To work around the described issues until patches can be installed, sites may consider removing the execute permissions from the Solaris telnet(1) utility. To accomplish this, the following command can be run (as "root"):

    # chmod 000 /usr/bin/telnet

To restore the original permissions to the telnet(1) utility (after the patches have been applied) the following command can be run (as "root"):

    # chmod 555 /usr/bin/telnet

5. Resolution

These issues are resolved in the following releases:

SPARC Platform

Solaris 7 with patch 119519-01 or later
Solaris 8 with patch 110668-05 or later
Solaris 9 with patch 119433-01 or later
Solaris 10 with patch 118560-01 or later

x86 Platform

Solaris 7 with patch 119520-01 or later
Solaris 8 with patch 110669-05 or later
Solaris 9 with patch 119434-01 or later
Solaris 10 with patch 118561-01 or later

Change History

29-Mar-2005:

All patches for resolution are released, re-release as "Resolved"

13-Jun-2005:

Updated with new information in "Impact" section to additionally include the new information on CAN-2005-0468 / IDEF0865 which is also resolved by the patches listed in this Sun Alert.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.