Re: FreeBSD remote root exploit ?

From: Assar Westerlund (assar@FreeBSD.ORG)
Date: 07/19/01 

To: Matt Dillon <dillon@earth.backplane.com>
From: Assar Westerlund <assar@FreeBSD.ORG>
Date: 19 Jul 2001 19:03:50 +0200

Matt Dillon <dillon@earth.backplane.com> writes:
> Lets see... There are actually *FOUR* telnetd's in our source tree.
>
> /usr/src/crypto/telnet/telnetd VULNERABLE
> /usr/src/libexec/telnetd VULNERABLE
> /usr/src/crypto/heimdal/appl/telnet/telnetd NOT VULNERABLE
> /usr/src/crypto/kerberosIV/appl/telnet/telnetd/telnetd.c NOT VULNERABLE

The last two are actually the `same', just from different versions
from the same CVS tree.

> The heimdal and kerberosIV telnetd's call an output_data()
> function which does not allow the output buffer to overflow. The
> first two telnetd' just blindly copy the option data into the output
> buffer.

The heimdal/kerberosIV are possibly less bad, but not blame-less, see
further down in the thread.

/assar

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • RE: OpenSSH b0rked (was RE: Problems with IPFW patch)
    ... I had kept that in mind before I did so. ... suggested that I compare the file from the source tree and the existing ... >> with "unsubscribe freebsd-security" in the body of the message ...
    (FreeBSD-Security)
  • Re: SA-02:13 - make depend fails
    ... > I'm following the directions applying the SA-02:13 patch, ... The patching instructions assume a full source tree. ... with "unsubscribe freebsd-security" in the body of the message ...
    (FreeBSD-Security)