OS: Linux x86 ntalkd Buffer Overflow

This signature detects attempts to exploit a known vulnerability in the name lookup facility in the talk daemon (talkd) running on LINUX. The talkd provides conversation between users. It also notifies users that another user wishes to establish a chat session. Because talkd must perform a name lookup of the initiating host, attackers can send a phony host name to talkd to overflow the buffer and gain root access.

Extended Description

The program talk is used to provide a two-way screen-oriented conversation between users. The talkd daemon is used to notify a user that another users wishes to establish a chat session. As part of this process, talkd must perform a name lookup of the initiating host. Due to a buffer overflow condition in talkd related to the name lookup facility, an unauthorized user may be able to pass bogus hostname information to talkd and gain root access.

Affected Products

Nec ux/4800

References

BugTraq: 210

CVE: CVE-1999-0048

URL: http://www.ecst.csuchico.edu/~jtmurphy/exploits/talkd-exploit http://www.securityfocus.com/advisories/151

Short Name

OS:LINUXX86:NTALKD-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

OS: Linux x86 ntalkd Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?