Quantum Secular Labs / Blog / Advisories

CVE-2001-0554: Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to…

CVE-2001-0554 has a CVSS v2 base score of 10.0 (the maximum on that scale) and NVD lists 11 affected products, including Mit Kerberos. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

Access vector: Network. Exploitable remotely over the network.
Access complexity: Low. No special conditions are required.
Authentication: None. No authentication is needed.
Confidentiality impact: Complete. Total information disclosure.
Integrity impact: Complete. Total loss of integrity.
Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-120: Buffer Copy without Checking Size of Input

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected products

Mit Kerberos: 1.0
Mit Kerberos 5: 1.1; 1.1.1; 1.2; 1.2.1; 1.2.2
Linux Netkit: 0.10; 0.11; 0.12
Sgi Irix: 6.5
Freebsd: 2.0; 2.0.1; 2.0.5; 2.1 stable; 2.1.0; 2.1.5; 2.1.6; 2.1.6.1; 2.1.7; 2.1.7.1; 2.2; 2.2 current
IBM AIX: 4.3; 4.3.1; 4.3.2; 4.3.3; 5.1
Netbsd: 1.0; 1.1; 1.2; 1.2.1; 1.3; 1.3.1; 1.3.2; 1.3.3; 1.4; 1.4.1; 1.4.2; 1.4.3
Openbsd: 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8
Sun Solaris: 2.6
Sunos: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; 5.5.1; 5.7; 5.8
Debian Linux: 2.2