Signature Detail

TELNET Options Overflow (Response)

This signature detects attempts to exploit a known vulnerability against the BSD-based TELNET daemon. The option processing function (telrcv) in the daemon produces responses with a fixed size buffer, but does not perform bounds checking. Attackers can send a combination of TELNET protocol options to the daemon to overflow the buffer and execute arbitrary commands.

Extended Description

A boundary condition error exists in telnet daemons derived from the BSD telnet daemon. Under certain circumstances, the buffer overflow can occur when a combination of telnet protocol options are received by the daemon. The function responsible for processing the options prepares a response within a fixed sized buffer, without performing any bounds checking. This vulnerability is now being actively exploited. A worm is known to be circulating around the Internet.

Affected Products

• Apple Mac OS X 10.0.0
• BSD BSD/OS 4.0.0
• BSD BSD/OS 4.0.1
• BSD BSD/OS 4.1.0
• BSD BSD/OS 4.2.0
• Cisco Catalyst 4000 4.5.0 (10)
• Cisco Catalyst 4000 4.5.0 (2)
• Cisco Catalyst 4000 4.5.0 (3)
• Cisco Catalyst 4000 4.5.0 (4)
• Cisco Catalyst 4000 4.5.0 (4B)
• Cisco Catalyst 4000 4.5.0 (5)
• Cisco Catalyst 4000 4.5.0 (6)
• Cisco Catalyst 4000 4.5.0 (7)
• Cisco Catalyst 4000 4.5.0 (8)
• Cisco Catalyst 4000 4.5.0 (9)
• Cisco Catalyst 4000 5.1.0
• Cisco Catalyst 4000 5.1.0 (1)
• Cisco Catalyst 4000 5.1.0 (1A)
• Cisco Catalyst 4000 5.1.0 (2A)
• Cisco Catalyst 4000 5.2.0
• Cisco Catalyst 4000 5.2.0 (1)
• Cisco Catalyst 4000 5.2.0 (1A)
• Cisco Catalyst 4000 5.2.0 (2)
• Cisco Catalyst 4000 5.2.0 (4)
• Cisco Catalyst 4000 5.2.0 (5)
• Cisco Catalyst 4000 5.2.0 (6)
• Cisco Catalyst 4000 5.2.0 (7)
• Cisco Catalyst 4000 5.4.0
• Cisco Catalyst 4000 5.4.0 (1)
• Cisco Catalyst 4000 5.4.0 (2)
• Cisco Catalyst 4000 5.4.0 (3)
• Cisco Catalyst 4000 5.4.1
• Cisco Catalyst 4000 5.5.0
• Cisco Catalyst 4000 5.5.0 (1)
• Cisco Catalyst 4000 5.5.0 (2)
• Cisco Catalyst 4000 5.5.0 (3)
• Cisco Catalyst 4000 5.5.0 (4)
• Cisco Catalyst 4000 5.5.0 (4B)
• Cisco Catalyst 4000 6.1.0 (1)
• Cisco Catalyst 4000 6.1.0 (1A)
• Cisco Catalyst 4000 6.1.0 (1B)
• Cisco Catalyst 4000 6.1.0 (1C)
• Cisco Catalyst 4000 7.1.0
• Cisco Catalyst 5000 4.5.0 (10)
• Cisco Catalyst 5000 4.5.0 (11)
• Cisco Catalyst 5000 4.5.0 (12)
• Cisco Catalyst 5000 4.5.0 (2)
• Cisco Catalyst 5000 4.5.0 (3)
• Cisco Catalyst 5000 4.5.0 (4)
• Cisco Catalyst 5000 4.5.0 (4B)
• Cisco Catalyst 5000 4.5.0 (5)
• Cisco Catalyst 5000 4.5.0 (6)
• Cisco Catalyst 5000 4.5.0 (7)
• Cisco Catalyst 5000 4.5.0 (8)
• Cisco Catalyst 5000 4.5.0 (9)
• Cisco Catalyst 5000 5.1.0
• Cisco Catalyst 5000 5.1.0 (1)
• Cisco Catalyst 5000 5.1.0 (2A)
• Cisco Catalyst 5000 5.2.0
• Cisco Catalyst 5000 5.2.0 (1)
• Cisco Catalyst 5000 5.2.0 (2)
• Cisco Catalyst 5000 5.2.0 (3)
• Cisco Catalyst 5000 5.2.0 (4)
• Cisco Catalyst 5000 5.4.0 (1)
• Cisco Catalyst 5000 5.4.0 (2)
• Cisco Catalyst 5000 5.4.0 (3)
• Cisco Catalyst 5000 5.4.0 (4)
• Cisco Catalyst 5000 5.4.1
• Cisco Catalyst 5000 5.5.0 (1)
• Cisco Catalyst 5000 5.5.0 (2)
• Cisco Catalyst 5000 5.5.0 (3)
• Cisco Catalyst 5000 5.5.0 (4)
• Cisco Catalyst 5000 5.5.0 (4B)
• Cisco Catalyst 5000 5.5.0 (6)
• Cisco Catalyst 5000 5.5.0 (7)
• Cisco Catalyst 5000 6.1.0 (1)
• Cisco Catalyst 5000 6.1.0 (1A)
• Cisco Catalyst 5000 6.1.0 (1B)
• Cisco Catalyst 5000 6.1.0 (1C)
• Cisco Catalyst 5000 6.1.0 (2)
• Cisco Catalyst 5000 6.1.0 (3)
• Cisco Catalyst 6000 5.3.0 (1A)CSX
• Cisco Catalyst 6000 5.3.0 (1)CSX
• Cisco Catalyst 6000 5.3.0 (2)CSX
• Cisco Catalyst 6000 5.3.0 (3)CSX
• Cisco Catalyst 6000 5.3.0 (4)CSX
• Cisco Catalyst 6000 5.3.0 (5A)CSX
• Cisco Catalyst 6000 5.3.0 (5)CSX
• Cisco Catalyst 6000 5.3.0 (6)CSX
• Cisco Catalyst 6000 5.4.0
• Cisco Catalyst 6000 5.4.0 (1)
• Cisco Catalyst 6000 5.4.0 (2)
• Cisco Catalyst 6000 5.4.0 (3)
• Cisco Catalyst 6000 5.4.0 (4)
• Cisco Catalyst 6000 5.4.1
• Cisco Catalyst 6000 5.5.0
• Cisco Catalyst 6000 5.5.0 (1)
• Cisco Catalyst 6000 5.5.0 (2)
• Cisco Catalyst 6000 5.5.0 (3)
• Cisco Catalyst 6000 5.5.0 (4)
• Cisco Catalyst 6000 5.5.0 (4A)
• Cisco Catalyst 6000 5.5.0 (4B)
• Cisco Catalyst 6000 6.1.0 (1)
• Cisco Catalyst 6000 6.1.0 (1A)
• Cisco Catalyst 6000 6.1.0 (1B)
• Cisco Catalyst 6000 6.1.0 (1C)
• Cisco Catalyst 6000 6.1.0 (2.13)
• Cisco Catalyst 6000 6.2.0 (0.110)
• Cisco Catalyst 6000 6.2.0 (0.111)
• Cisco Catalyst 6000 6.3.0 (0.7)PAN
• Cisco Catalyst 6000 7.1.0
• Cisco VPN 3000 Concentrator 2.0.0
• Cisco VPN 3000 Concentrator 2.5.2 (A)
• Cisco VPN 3000 Concentrator 2.5.2 (B)
• Cisco VPN 3000 Concentrator 2.5.2 (C)
• Cisco VPN 3000 Concentrator 2.5.2 (D)
• Cisco VPN 3000 Concentrator 2.5.2 (F)
• Cisco VPN 3000 Concentrator 3.0.0
• Cisco VPN 3000 Concentrator 3.0.3 (A)
• Cisco VPN 3000 Concentrator 3.0.3 (B)
• Debian Linux 3.0.0
• Debian Linux 3.0.0 Alpha
• Debian Linux 3.0.0 Arm
• Debian Linux 3.0.0 Hppa
• Debian Linux 3.0.0 Ia-32
• Debian Linux 3.0.0 Ia-64
• Debian Linux 3.0.0 M68k
• Debian Linux 3.0.0 Mips
• Debian Linux 3.0.0 Mipsel
• Debian Linux 3.0.0 Ppc
• Debian Linux 3.0.0 S/390
• Debian Linux 3.0.0 Sparc
• FreeBSD 2.X
• FreeBSD 3.5.1
• FreeBSD 3.5.1 -RELEASE
• FreeBSD 3.5.1 -STABLE
• FreeBSD 3.X
• FreeBSD 4.0.0 .X
• FreeBSD 4.1.1
• FreeBSD 4.1.1 -RELEASE
• FreeBSD 4.1.1 -STABLE
• FreeBSD 4.2.0
• FreeBSD 4.2.0 -RELEASE
• FreeBSD 4.2.0 -STABLE
• FreeBSD 4.3.0
• FreeBSD 4.3.0 -RELEASE
• FreeBSD 4.3.0 -STABLE
• HP HP-UX 10.0.0 1
• HP HP-UX 10.10.0
• HP HP-UX 10.20.0
• HP HP-UX 10.20.0 SIS
• HP HP-UX 10.24.0
• HP Secure OS software for Linux 1.0.0
• IBM AIX 4.3.0
• IBM AIX 4.3.1
• IBM AIX 4.3.2
• IBM AIX 4.3.3
• IBM AIX 5.1
• MIT Kerberos 5 1.0.0
• MIT Kerberos 5 1.1.0
• MIT Kerberos 5 1.1.1
• MIT Kerberos 5 1.2.0
• MIT Kerberos 5 1.2.1
• MIT Kerberos 5 1.2.2
• NetBSD 1.0.0
• NetBSD 1.1.0
• NetBSD 1.2.0
• NetBSD 1.2.1
• NetBSD 1.3.0
• NetBSD 1.3.1
• NetBSD 1.3.2
• NetBSD 1.3.3
• NetBSD 1.4.0
• NetBSD 1.4.1
• NetBSD 1.4.2
• NetBSD 1.4.3
• NetBSD 1.5.0
• NetBSD 1.5.1
• Netkit Linux Netkit 0.10.0
• Netkit Linux Netkit 0.11.0
• Netkit Linux Netkit 0.12.0
• Netkit Linux Netkit 0.14.0
• Netkit Linux Netkit 0.16.0
• Netkit Linux Netkit 0.17.0
• OpenBSD 2.0.0
• OpenBSD 2.1.0
• OpenBSD 2.2.0
• OpenBSD 2.3.0
• OpenBSD 2.4.0
• OpenBSD 2.5.0
• OpenBSD 2.6.0
• OpenBSD 2.7.0
• OpenBSD 2.8.0
• SCO Open Server 5.0.5
• SCO Open Server 5.0.6
• SGI IRIX 6.5.0
• SGI IRIX 6.5.1
• SGI IRIX 6.5.10
• SGI IRIX 6.5.11
• SGI IRIX 6.5.12
• SGI IRIX 6.5.13
• SGI IRIX 6.5.2
• SGI IRIX 6.5.3
• SGI IRIX 6.5.4
• SGI IRIX 6.5.5
• SGI IRIX 6.5.6
• SGI IRIX 6.5.7
• SGI IRIX 6.5.8
• SGI IRIX 6.5.9
• Sun Solaris 2.0
• Sun Solaris 2.1
• Sun Solaris 2.2
• Sun Solaris 2.3
• Sun Solaris 2.4
• Sun Solaris 2.5
• Sun Solaris 2.5.1
• Sun Solaris 2.6
• Sun Solaris 7.0
• Sun Solaris 8 Sparc

References

• BugTraq: 3064
• CERT: CA-2001-21
• CVE: CVE-2001-0554