| VID |
14004 |
| Severity |
40 |
| Port |
23 |
| Protocol |
TCP |
| Class |
TELNET |
| Detailed Description |
The telnet daemon appears to be vulnerable to a format string attack.
A vulnerability exists in the telnet daemon shipped with Irix versions 6.2 through 6.5.8, and in patched versions of the telnet daemon in Irix 5.2 through 6.1, from Silicon Graphics (SGI). The telnetd will blindly use data passed by the user in such a way as to make it possible for a remote attacker to execute arbitrary commands with the privileges of the daemon. In the case of the telnet daemon, this is root privileges.
The telnet daemon, upon receiving a request via IAB-SB-TELOPT_ENVIRON request to set one of the _RLD environment variables, will log this attempt via syslog(). The data normally logged is the environment variable name, and the value of the environment variable. The call to syslog, however, uses the supplied variables as part of the format string. By carefully constructing the contents of these variables, it is possible to overwrite values on the stack such that supplied code may be executed as the root user.
* References:
http://online.securityfocus.com/bid/1572
http://www.cert.org/advisories/CA-1995-14.html |
| Recommendation |
If the telnet service is not required on this system, or has been replaced with a secure alternative (e.g. ssh), telnetd should be disabled.
* To disable TELNET service :
1. Become the root user on the system.
% su
Password:
#
2. Edit the file /etc/inetd.conf (for IRIX 5.3 and lower, edit /usr/etc/inetd.conf).
Place a "#" as the first character of the line to comment out.
# vi /etc/inetd.conf
telnet stream tcp nowait root /usr/etc/telnetd telnetd
=> #telnet stream tcp nowait root /usr/etc/telnetd telnetd
3. Force inetd to re-read the configuration file.
# /etc/killall -HUP inetd
4. Kill any existing telnetd process.
# /etc/killall telnetd
5. Return to previous level
# exit
%
-- OR ---
If telnet is required, patches should be applied immediately. Refer to the following site to patch the daemon.
* IRIX 5.2-6.4 Recommended/Required Patch Sets :
http://support.sgi.com/irix/ and ftp://patches.sgi.com/support/patchset/
* IRIX 6.5 Maintenance Release Streams :
http://support.sgi.com/colls/patches/tools/relstream/index.html |
| Related URL |
CVE-2000-0733 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
