• Product Information
• Security Products Overview
• Juniper Networks ISG Series
• IDP Demo
• Product Poster & Z-Card 

Title: Multiple Vendor Telnetd Buffer Overflow Vulnerability

Severity: CRITICAL

Description:

A boundary condition error exists in telnet daemons derived from the BSD telnet daemon.

The telnet protocol defines numerous control functions as a means of setting options for a telnet connection. An internal function, 'telrcv,' is responsible for processing such options. The function parses the options and prepares a response within a fixed-size buffer. No bounds checking is performed.

Under certain circumstances, a combination of these options can trigger a buffer overflow. This condition could lead to stack frame corruption, possibling enabling a remote attacker to execute arbitrary code.

This vulnerability is now being actively exploited. A worm is known to be circulating around the Internet.

Affected Products:

• Apple Mac OS X 10.0.0
• BSDI BSD/OS 4.0.0
• BSDI BSD/OS 4.0.1
• BSDI BSD/OS 4.1.0
• BSDI BSD/OS 4.2.0
• Caldera OpenLinux 2.3.0
• Caldera OpenLinux 2.4.0
• Cisco Catalyst 4000 4.5.0(10)
• Cisco Catalyst 4000 4.5.0(2)
• Cisco Catalyst 4000 4.5.0(3)
• Cisco Catalyst 4000 4.5.0(4)
• Cisco Catalyst 4000 4.5.0(4b)
• Cisco Catalyst 4000 4.5.0(5)
• Cisco Catalyst 4000 4.5.0(6)
• Cisco Catalyst 4000 4.5.0(7)
• Cisco Catalyst 4000 4.5.0(8)
• Cisco Catalyst 4000 4.5.0(9)
• Cisco Catalyst 4000 5.1.0
• Cisco Catalyst 4000 5.1.0(1)
• Cisco Catalyst 4000 5.1.0(1a)
• Cisco Catalyst 4000 5.1.0(2a)
• Cisco Catalyst 4000 5.2.0
• Cisco Catalyst 4000 5.2.0(1)
• Cisco Catalyst 4000 5.2.0(1a)
• Cisco Catalyst 4000 5.2.0(2)
• Cisco Catalyst 4000 5.2.0(4)
• Cisco Catalyst 4000 5.2.0(5)
• Cisco Catalyst 4000 5.2.0(6)
• Cisco Catalyst 4000 5.2.0(7)
• Cisco Catalyst 4000 5.4.0
• Cisco Catalyst 4000 5.4.0(1)
• Cisco Catalyst 4000 5.4.0(2)
• Cisco Catalyst 4000 5.4.0(3)
• Cisco Catalyst 4000 5.4.1
• Cisco Catalyst 4000 5.5.0
• Cisco Catalyst 4000 5.5.0(1)
• Cisco Catalyst 4000 5.5.0(2)
• Cisco Catalyst 4000 5.5.0(3)
• Cisco Catalyst 4000 5.5.0(4)
• Cisco Catalyst 4000 5.5.0(4b)
• Cisco Catalyst 4000 6.1.0(1)
• Cisco Catalyst 4000 6.1.0(1a)
• Cisco Catalyst 4000 6.1.0(1b)
• Cisco Catalyst 4000 6.1.0(1c)
• Cisco Catalyst 4000 7.1.0
• Cisco Catalyst 5000 4.5.0(10)
• Cisco Catalyst 5000 4.5.0(11)
• Cisco Catalyst 5000 4.5.0(12)
• Cisco Catalyst 5000 4.5.0(2)
• Cisco Catalyst 5000 4.5.0(3)
• Cisco Catalyst 5000 4.5.0(4)
• Cisco Catalyst 5000 4.5.0(4b)
• Cisco Catalyst 5000 4.5.0(5)
• Cisco Catalyst 5000 4.5.0(6)
• Cisco Catalyst 5000 4.5.0(7)
• Cisco Catalyst 5000 4.5.0(8)
• Cisco Catalyst 5000 4.5.0(9)
• Cisco Catalyst 5000 5.1.0
• Cisco Catalyst 5000 5.1.0(1)
• Cisco Catalyst 5000 5.1.0(2a)
• Cisco Catalyst 5000 5.2.0
• Cisco Catalyst 5000 5.2.0(1)
• Cisco Catalyst 5000 5.2.0(2)
• Cisco Catalyst 5000 5.2.0(3)
• Cisco Catalyst 5000 5.2.0(4)
• Cisco Catalyst 5000 5.4.0(1)
• Cisco Catalyst 5000 5.4.0(2)
• Cisco Catalyst 5000 5.4.0(3)
• Cisco Catalyst 5000 5.4.0(4)
• Cisco Catalyst 5000 5.4.1
• Cisco Catalyst 5000 5.5.0(1)
• Cisco Catalyst 5000 5.5.0(2)
• Cisco Catalyst 5000 5.5.0(3)
• Cisco Catalyst 5000 5.5.0(4)
• Cisco Catalyst 5000 5.5.0(4b)
• Cisco Catalyst 5000 5.5.0(6)
• Cisco Catalyst 5000 5.5.0(7)
• Cisco Catalyst 5000 6.1.0(1)
• Cisco Catalyst 5000 6.1.0(1a)
• Cisco Catalyst 5000 6.1.0(1b)
• Cisco Catalyst 5000 6.1.0(1c)
• Cisco Catalyst 5000 6.1.0(2)
• Cisco Catalyst 5000 6.1.0(3)
• Cisco Catalyst 6000 5.3.0(1)CSX
• Cisco Catalyst 6000 5.3.0(1a)CSX
• Cisco Catalyst 6000 5.3.0(2)CSX
• Cisco Catalyst 6000 5.3.0(3)CSX
• Cisco Catalyst 6000 5.3.0(4)CSX
• Cisco Catalyst 6000 5.3.0(5)CSX
• Cisco Catalyst 6000 5.3.0(5a)CSX
• Cisco Catalyst 6000 5.3.0(6)CSX
• Cisco Catalyst 6000 5.4.0
• Cisco Catalyst 6000 5.4.0(1)
• Cisco Catalyst 6000 5.4.0(2)
• Cisco Catalyst 6000 5.4.0(3)
• Cisco Catalyst 6000 5.4.0(4)
• Cisco Catalyst 6000 5.4.1
• Cisco Catalyst 6000 5.5.0
• Cisco Catalyst 6000 5.5.0(1)
• Cisco Catalyst 6000 5.5.0(2)
• Cisco Catalyst 6000 5.5.0(3)
• Cisco Catalyst 6000 5.5.0(4)
• Cisco Catalyst 6000 5.5.0(4a)
• Cisco Catalyst 6000 5.5.0(4b)
• Cisco Catalyst 6000 6.1.0(1)
• Cisco Catalyst 6000 6.1.0(1a)
• Cisco Catalyst 6000 6.1.0(1b)
• Cisco Catalyst 6000 6.1.0(1c)
• Cisco Catalyst 6000 6.1.0(2.13)
• Cisco Catalyst 6000 6.2.0(0.110)
• Cisco Catalyst 6000 6.2.0(0.111)
• Cisco Catalyst 6000 6.3.0(0.7)PAN
• Cisco Catalyst 6000 7.1.0
• Cisco VPN 3000 Concentrator 2.0.0
• Cisco VPN 3000 Concentrator 2.5.2(A)
• Cisco VPN 3000 Concentrator 2.5.2(B)
• Cisco VPN 3000 Concentrator 2.5.2(C)
• Cisco VPN 3000 Concentrator 2.5.2(D)
• Cisco VPN 3000 Concentrator 2.5.2(F)
• Cisco VPN 3000 Concentrator 3.0.0
• Cisco VPN 3000 Concentrator 3.0.3(A)
• Cisco VPN 3000 Concentrator 3.0.3(B)
• Debian Linux 2.2.0
• Debian Linux 2.2.0 68k
• Debian Linux 2.2.0 alpha
• Debian Linux 2.2.0 arm
• Debian Linux 2.2.0 powerpc
• Debian Linux 2.2.0 sparc
• Debian Linux 3.0.0
• Debian Linux 3.0.0 alpha
• Debian Linux 3.0.0 arm
• Debian Linux 3.0.0 hppa
• Debian Linux 3.0.0 ia-32
• Debian Linux 3.0.0 ia-64
• Debian Linux 3.0.0 m68k
• Debian Linux 3.0.0 mips
• Debian Linux 3.0.0 mipsel
• Debian Linux 3.0.0 ppc
• Debian Linux 3.0.0 s/390
• Debian Linux 3.0.0 sparc
• FreeBSD FreeBSD 2.x
• FreeBSD FreeBSD 3.5.1 -RELEASE
• FreeBSD FreeBSD 3.5.1 -STABLE
• FreeBSD FreeBSD 3.x
• FreeBSD FreeBSD 4.0.0 .x
• FreeBSD FreeBSD 4.1.1 -RELEASE
• FreeBSD FreeBSD 4.1.1 -STABLE
• FreeBSD FreeBSD 4.2.0 -RELEASE
• FreeBSD FreeBSD 4.2.0 -STABLE
• FreeBSD FreeBSD 4.3.0 -RELEASE
• FreeBSD FreeBSD 4.3.0 -STABLE
• Gentoo Linux
• HP HP-UX 10.0.01
• HP HP-UX 10.10.0
• HP HP-UX 10.20.0
• HP HP-UX 10.20.0 SIS
• HP HP-UX 10.24.0
• HP Secure OS software for Linux 1.0.0
• IBM AIX 4.3.0
• IBM AIX 4.3.1
• IBM AIX 4.3.2
• IBM AIX 4.3.3
• IBM AIX 5.1.0
• MIT Kerberos 5 1.0.0
• MIT Kerberos 5 1.1.0
• MIT Kerberos 5 1.1.1
• MIT Kerberos 5 1.2.0
• MIT Kerberos 5 1.2.1
• MIT Kerberos 5 1.2.2
• MandrakeSoft Linux Mandrake 8.1.0
• MandrakeSoft Linux Mandrake 8.1.0 ia64
• MandrakeSoft Linux Mandrake 8.2.0
• MandrakeSoft Linux Mandrake 8.2.0 ppc
• MandrakeSoft Multi Network Firewall 2.0.0
• NetBSD NetBSD 1.0.0
• NetBSD NetBSD 1.1.0
• NetBSD NetBSD 1.2.0
• NetBSD NetBSD 1.2.1
• NetBSD NetBSD 1.3.0
• NetBSD NetBSD 1.3.1
• NetBSD NetBSD 1.3.2
• NetBSD NetBSD 1.3.3
• NetBSD NetBSD 1.4.0
• NetBSD NetBSD 1.4.1
• NetBSD NetBSD 1.4.2
• NetBSD NetBSD 1.4.3
• NetBSD NetBSD 1.5.0
• NetBSD NetBSD 1.5.1
• Netkit Linux Netkit 0.10.0
• Netkit Linux Netkit 0.11.0
• Netkit Linux Netkit 0.12.0
• Netkit Linux Netkit 0.14.0
• Netkit Linux Netkit 0.16.0
• Netkit Linux Netkit 0.17.0
• OpenBSD OpenBSD 2.0.0
• OpenBSD OpenBSD 2.1.0
• OpenBSD OpenBSD 2.2.0
• OpenBSD OpenBSD 2.3.0
• OpenBSD OpenBSD 2.4.0
• OpenBSD OpenBSD 2.5.0
• OpenBSD OpenBSD 2.6.0
• OpenBSD OpenBSD 2.7.0
• OpenBSD OpenBSD 2.8.0
• RedHat Desktop 3.0.0
• RedHat Desktop 4.0.0
• RedHat Enterprise Linux AS 2.1
• RedHat Enterprise Linux AS 2.1 IA64
• RedHat Enterprise Linux AS 3
• RedHat Enterprise Linux AS 4
• RedHat Enterprise Linux ES 2.1
• RedHat Enterprise Linux ES 2.1 IA64
• RedHat Enterprise Linux ES 3
• RedHat Enterprise Linux ES 4
• RedHat Enterprise Linux WS 2.1
• RedHat Enterprise Linux WS 2.1 IA64
• RedHat Enterprise Linux WS 3
• RedHat Enterprise Linux WS 4
• RedHat Linux 5.2.0
• RedHat Linux 5.2.0 alpha
• RedHat Linux 5.2.0 i386
• RedHat Linux 5.2.0 sparc
• RedHat Linux 6.2.0
• RedHat Linux 6.2.0 alpha
• RedHat Linux 6.2.0 i386
• RedHat Linux 6.2.0 sparc
• RedHat Linux 7.0.0
• RedHat Linux 7.0.0 alpha
• RedHat Linux 7.0.0 i386
• RedHat Linux 7.0.0 sparc
• RedHat Linux 7.1.0
• RedHat Linux 7.1.0 alpha
• RedHat Linux 7.1.0 i386
• RedHat Linux 7.1.0 ia64
• RedHat Linux 7.2.0
• RedHat Linux 7.2.0 i386
• RedHat Linux 7.2.0 ia64
• SCO Open Server 5.0.5
• SCO Open Server 5.0.6
• SCO eDesktop 2.4.0
• SCO eServer 2.3.1
• SGI IRIX 6.5.0
• SGI IRIX 6.5.1
• SGI IRIX 6.5.10
• SGI IRIX 6.5.11
• SGI IRIX 6.5.12
• SGI IRIX 6.5.13
• SGI IRIX 6.5.2
• SGI IRIX 6.5.3
• SGI IRIX 6.5.4
• SGI IRIX 6.5.5
• SGI IRIX 6.5.6
• SGI IRIX 6.5.7
• SGI IRIX 6.5.8
• SGI IRIX 6.5.9
• Sun Solaris 10
• Sun Solaris 2.0.0
• Sun Solaris 2.1.0
• Sun Solaris 2.2.0
• Sun Solaris 2.3.0
• Sun Solaris 2.4.0
• Sun Solaris 2.5.0
• Sun Solaris 2.5.1
• Sun Solaris 2.6
• Sun Solaris 7.0
• Sun Solaris 7.0_x86
• Sun Solaris 8
• Sun Solaris 8_x86
• Sun Solaris 9
• Sun Solaris 9_x86
• Sun Solaris 9_x86 Update 2
• Ubuntu Ubuntu Linux 4.1.0 ia32
• Ubuntu Ubuntu Linux 4.1.0 ia64
• Ubuntu Ubuntu Linux 4.1.0 ppc

References:

• CERT/CC: CERT Advisory CA-2001-21: Buffer Overflow in telnetd
• Cisco Systems: Cisco Security Advisory: Cisco CatOS Telnet Buffer Vulnerability

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.