3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
142 lines
5.6 KiB
Text
142 lines
5.6 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:54 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: telnetd contains remote buffer overflow
|
|
|
|
Category: ports
|
|
Modules: krb5/heimdal/SSLtelnet
|
|
Announced: 2001-08-20
|
|
Credits: Sebastian <scut@nb.in-berlin.de>
|
|
Affects: Ports collection prior to the correction date.
|
|
Corrected: 2001-07-19 21:43:41 UTC (heimdal)
|
|
2001-07-24 15:29:39 UTC (krb5)
|
|
SSLtelnet port not yet corrected
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
telnetd is the server for the telnet remote virtual terminal protocol.
|
|
|
|
II. Problem Description
|
|
|
|
This advisory is closely related to the previously released
|
|
FreeBSD-SA-01:49.telnetd.v1.1 advisory. That advisory pertains to the
|
|
telnetd included in the base FreeBSD system. This advisory pertains
|
|
to optional third-party telnetd implementations found in the FreeBSD
|
|
ports collection.
|
|
|
|
An overflowable buffer was found in the versions of telnetd included
|
|
with several ports. These ports include:
|
|
|
|
MIT Kerberos V (security/krb5) prior to version 1.2.2_2
|
|
Heimdal (security/heimdal) prior to version 0.4b_1
|
|
SSLtelnet (net/SSLtelnet) - this port is not yet fixed; see below.
|
|
|
|
Due to incorrect bounds checking of data buffered for output to the
|
|
remote client, an attacker can cause the telnetd process to overflow
|
|
the buffer and crash, or execute arbitrary code as the user running
|
|
telnetd, usually root. A valid user account and password is not
|
|
required to exploit this vulnerability, only the ability to connect to
|
|
a telnetd server.
|
|
|
|
These ports are not installed by default, nor are they "part of
|
|
FreeBSD" as such: they are part of the FreeBSD ports collection, which
|
|
contains over 5600 third-party applications in a ready-to-install
|
|
format. The ports collection shipped with FreeBSD 4.3 is vulnerable to
|
|
this problem since it was discovered after its release, but the
|
|
problems with the krb5 and heimdal ports were corrected prior to the
|
|
(forthcoming) release of FreeBSD 4.4.
|
|
|
|
The SSLtelnet vulnerability has not yet been corrected: due to
|
|
divergences in the code, it is more difficult to correct the
|
|
vulnerability in that port. This advisory will be reissued once the
|
|
vulnerability is corrected.
|
|
|
|
III. Impact
|
|
|
|
Remote users can cause arbitrary code to be executed as the user
|
|
running telnetd, usually root.
|
|
|
|
IV. Workaround
|
|
|
|
1) Disable the telnet service, which is usually run out of inetd:
|
|
comment out lines in /etc/inetd.conf that begin with the word `telnet',
|
|
if present, e.g.
|
|
|
|
telnet stream tcp nowait root /usr/local/libexec/telnetd telnetd
|
|
|
|
telnet stream tcp6 nowait root /usr/local/libexec/telnetd telnetd
|
|
|
|
and execute the following command as root:
|
|
|
|
# kill -HUP `cat /var/run/inetd.pid`
|
|
|
|
2) Impose access restrictions using TCP wrappers (/etc/hosts.allow),
|
|
or a network-level packet filter such as ipfw(8) or ipf(8) on the
|
|
perimeter firewall or the local machine, to limit access to the telnet
|
|
service to trusted machines.
|
|
|
|
3) Deinstall the affected ports/packages if they are installed.
|
|
|
|
V. Solution
|
|
|
|
The updated ports include fixes for this vulnerability:
|
|
krb5-1.2.2_2 and later
|
|
heimdal-0.4b_1 and later
|
|
|
|
1) Upgrade your entire ports collection and rebuild the affected
|
|
ports (packages are not currently available for these ports).
|
|
|
|
2) Download a new port skeleton for the affected ports from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
3) Use the portcheckout utility to automate option (2) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the revision numbers of each file that was
|
|
corrected in the FreeBSD ports collection.
|
|
|
|
Affected port (module)
|
|
Path Revision
|
|
- -------------------------------------------------------------------------
|
|
MIT Kerberos V (krb5)
|
|
ports/security/krb5/Makefile 1.27
|
|
ports/security/krb5/files/patch-appl::telnet::telnetd::authenc.c 1.1
|
|
ports/security/krb5/files/patch-appl::telnet::telnetd::ext.h 1.2
|
|
ports/security/krb5/files/patch-appl::telnet::telnetd::slc.c 1.1
|
|
ports/security/krb5/files/patch-appl::telnet::telnetd::state.c 1.2
|
|
ports/security/krb5/files/patch-appl::telnet::telnetd::telnetd.c 1.2
|
|
ports/security/krb5/files/patch-appl::telnet::telnetd::termstat.c 1.1
|
|
ports/security/krb5/files/patch-appl::telnet::telnetd::utility.c 1.2
|
|
Heimdal (heimdal)
|
|
ports/security/heimdal/Makefile 1.39
|
|
ports/security/heimdal/files/patch-ad 1.6
|
|
- -------------------------------------------------------------------------
|
|
|
|
VII. References
|
|
|
|
<URL:http://www.securityfocus.com/advisories/3463>
|
|
<URL:http://www.team-teso.net/advisories/teso-advisory-011.tar.gz>
|
|
<URL:ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:49.telnetd.v1.1.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.6 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBO4GGS1UuHi5z0oilAQENdgQAn48FDb8KqMftJGSS2ueRb9aZPuosS/3T
|
|
2I6AC3AOtBIKe+3fhnURdivPIXBWMZ4GyzkctfvQ0NaKUnnVqTzoxdSVN4wStJ1e
|
|
yXdJ9b4d5lyKvT0+JJI9IMylcA5o5kp5b36OpkB48Oo3y/4ZdiskJn3ZoU4zpBeU
|
|
+uCUTpg3TGM=
|
|
=SChg
|
|
-----END PGP SIGNATURE-----
|