[NT] Absolute Telnet Remote Buffer Overflow Vulnerability

From: support@securiteam.com
Date: 02/10/03

  • Next message: support@securiteam.com: "[TOOL] Cisilia, Cluster Based Password Brute Forcer" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 10 Feb 2003 14:50:48 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      Absolute Telnet Remote Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    <A HREF="http://www.celestialsoftware.net/telnet/index.html
    ">Celestial software's AbsoluteTelnet is "the ultimate terminal client, it
    provides the most rock-solid emulations, the best security, and the
    fastest throughput of all terminal clients, along with unrelenting
    performance and stellar features". A vulnerability in the product allows a
    local attacker (to the computer to which the user is connected to) to
    cause the product to crash and execute arbitrary code.

    DETAILS

    Vulnerable systems:
     * AbsoluteTelnet version 2.00
     * AbsoluteTelnet version 2.11

    Immune systems:
     *AbsoluteTelnet version 2.12 RC10

    Insufficient bounds checking in the code that sets the programs titlebar
    leads to execution of arbitrary code. The following will reproduce the
    problem/set EIP to 0x0:

    export KNUD=`perl -e 'print "A" x 174'`
    echo -ne "\033]0;$KNUD\007"

    And the following will set EBP/EIP to 0x41414141, hence allowing the
    execution of attacker-supplied code.

    export KNUD=`perl -e 'print "A" x 296'`
    echo -ne "\033]0;$KNUD\007"

    Analysis:
    A user able to entice the victim to 'cat' a file will be able to perform
    this attack. AbsoluteTelnet may furthermore be selected as the "default
    telnet client", which will enable an attacker to exploit this via amongst
    other means, a meta refresh such as
    <META HTTP-EQUIV="Refresh" CONTENT="0;URL=telnet://hostile.serv.er">.

    Furthermore the SSH login/password is kept in plaintext in memory
    throughout the entire session, which might enable the attacker to recover
    this as well.

    Workaround:
     <http://www.celestialsoftware.net/telnet/beta_software.html>
    http://www.celestialsoftware.net/telnet/beta_software.html has an updated
    beta version.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:kain@ircop.dk> Knud.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages

    • [NT] Buffer Overrun in Windows Help and Support Center Could Lead to System Compromise (MS03-044)
      ... Get your security news from a reliable source. ... A security vulnerability exists in the Help and Support Center function ... *Microsoft Windows Millennium Edition ... An attacker could exploit the vulnerability by constructing a URL that, ...
      (Securiteam)
    • [UNIX] Security Analysis of VTun
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An attacker can modify ... Packet forwarding: ... password) as encryption key. ...
      (Securiteam)
    • [REVS] Security Considerations for Web-based Applications
      ... Get your security news from a reliable source. ... consequences of this ranges from the erosion of customer confidence in the ... of poorly implemented host naming procedures or web-application URL ... The attacker may choose to inject ...
      (Securiteam)
    • [NT] Windows Media Player Directory Traversal Vulnerability (WMZ)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... When Media Player 7 or 8 is installed, ... As most other Internet Explorer vulnerabilities, ... cannot be guessed by a potential attacker. ...
      (Securiteam)
    • [NT] MHTML vulnerability in Outlook Express
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in Outlook Express allows an attacker to run code of the ... If an attacker were to host a malicious website that contained an MHTML ...
      (Securiteam)