April 2005

ID: 00301
Ref: 279/2005
Date: 11 April 2005:14:16:24
Version: 1

---

Title: Buffer Overflow in telnet(1) Client Software Also Affects Kerberized Telnet
Abstract:
Vendors affected: Sun
Operating systems affected: Sun
Applications affected: Sun

---

Title
=====

Buffer Overflow in telnet(1) Client Software Also Affects Kerberized Telnet

Detail
======

There is a buffer overflow in the unprivileged kerberized telnet(1) utility of
Sun Enterprise Authentication Mechanism (SEAM) Software for Solaris. This is not a
security vulnerability on its own. However, kerberized telnet(1) communicates with
another host using the TELNET protocol and thus there is a small risk of a remote
user successfully exploiting the overflow.


PLEASE NOTE- The following is a plain text copy of a Sun SunSolve web page,
which is located at:
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-57761-1


Document Audience: PUBLIC
Document ID: 57761
Title: Buffer Overflow in telnet(1) Client Software Also Affects
Kerberized Telnet
Update Date: 2005-04-07

- --------------------------------------------------------------------------------
Description
- --------------------------------------------------------------------------------
Sun(sm) Alert Notification

Sun Alert ID: 57761
Synopsis: Buffer Overflow in telnet(1) Client Software Also Affects Kerberized
Telnet
Category: Security
Product: Sun Enterprise Authentication Mechanism Software
BugIDs: 6248576
Avoidance: Workaround
State: Engineering Complete
Date Released: 07-Apr-2005
Date Closed:
Date Modified:

1. Impact
There is a buffer overflow in the unprivileged kerberized telnet(1) utility of
Sun Enterprise Authentication Mechanism (SEAM) Software for Solaris. This is not a security
vulnerability on its own. However, kerberized telnet(1) communicates with another host
using the TELNET protocol and thus there is a small risk of a remote user successfully
exploiting the overflow.

If a remote unprivileged user is able to cause a user to execute the kerberized telnet(1)
utility on their client system, then that remote user may be able to execute arbitrary
commands on the client system with the privileges of the user who executed kerberized
telnet(1).

This issue is described in CAN-2005-0469 at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0469.

This issue is also described in the following CERT Vulnerability Notes:

VU#291924 at http://www.kb.cert.org/vuls/id/291924

VU#341908 at http://www.kb.cert.org/vuls/id/341908

Sun acknowledges with thanks, iDEFENSE (http://www.idefense.com), for bringing this issue
to our attention. This issue is also referenced in the following iDEFENSE documents:

IDEF0866 - Multiple Telnet Client slc_add_reply() Buffer Overflow at
http://www.idefense.com/application/poi/display?id=220

IDEF0867 - Multiple Telnet Client env_opt_add() Buffer Overflow at
http://www.idefense.com/application/poi/display?id=221


2. Contributing Factors
This issue can occur in the following releases:

SPARC Platform

SEAM 1.0 (for Solaris 7)
SEAM 1.0.1 (for Solaris 8)
SEAM 1.0.2 (for Solaris 9)
x86 Platform

SEAM 1.0 (for Solaris 7)
SEAM 1.0.1 (for Solaris 8)
SEAM 1.0.2 (for Solaris 9)
Notes:

Solaris Enterprise Authentication Mechanism (SEAM) is an unbundled product
available for Solaris 7, 8 and 9. For more information on SEAM, please see
the SEAM(5) man page.

For Solaris without SEAM, see Sun Alert 57755 at
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57755-1.
There is no unbundled SEAM product for Solaris 10. For systems configured to
use Kerberized telnet in Solaris 10, also see Sun Alert 57755.

3. Symptoms
There are no predictable symptoms that would indicate the described issue has been
exploited.


- --------------------------------------------------------------------------------
Solution
- --------------------------------------------------------------------------------

4. Relief/Workaround
To work around the described issue until patches can be installed, sites may consider
removing the execute permissions from the kerberized telnet(1) utility. To accomplish
this, the following command can be run (as "root"):

# chmod 000 /usr/krb5/bin/telnet

To restore the original permissions to the telnet(1) utility (after the patches have been
applied) the following command can be run (as "root"):

# chmod 555 /usr/krb5/bin/telnet


5. Resolution
A final resolution is pending completion.


This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert
notification may contain information provided by third parties. The issues described in
this Sun Alert notification may or may not impact your system(s). Sun makes no
representations, warranties, or guarantees as to the information contained herein. ANY AND
ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED.
BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY
DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE
OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun
proprietary and confidential information. It is being provided to you pursuant to the
provisions of your agreement to purchase services from Sun, or, if you do not have such an
agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the
purposes contemplated by these agreements.

Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A.
All rights reserved.

Applies To
- -

Attachments
- -