TELNET Options Overflow (Response)

This signature detects attempts to exploit a known vulnerability against the BSD-based TELNET daemon. The option processing function (telrcv) in the daemon produces responses with a fixed size buffer, but does not perform bounds checking. Attackers can send a combination of TELNET protocol options to the daemon to overflow the buffer and execute arbitrary commands.

Extended Description

A boundary condition error exists in telnet daemons derived from the BSD telnet daemon. Under certain circumstances, the buffer overflow can occur when a combination of telnet protocol options are received by the daemon. The function responsible for processing the options prepares a response within a fixed sized buffer, without performing any bounds checking. This vulnerability is now being actively exploited. A worm is known to be circulating around the Internet.

Affected Products

Cisco catalyst_5000,Openbsd openbsd

References

BugTraq: 3064

CVE: CVE-2001-0554

Short Name

TELNET:OVERFLOW:OPTIONS-REPLY

Severity

Major

Recommended

False

Recommended Action

Drop

TELNET Options Overflow (Response)

Extended Description

Affected Products

References

Found a potential security threat?