Bug 1676393 (CVE-2018-20764)

Summary:	CVE-2018-20764 tcpcrypt: buffer overflow vulnerability leading to privilege escalation
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	carnil, gmollett, msiddiqu, pwouters, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:47:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1676394, 1676395
Bug Blocks:

Description msiddiqu 2019-02-12 07:48:54 UTC

A buffer overflow exists in HelpSystems tcpcrypt on Linux, used for BoKS encrypted telnet through BoKS version 6.7.1. Since tcpcrypt is setuid, exploitation leads to privilege escalation.

Comment 1 msiddiqu 2019-02-12 07:49:18 UTC

Created tcpcrypt tracking bugs for this issue:

Affects: epel-7 [bug 1676395]
Affects: fedora-all [bug 1676394]

Comment 3 Salvatore Bonaccorso 2019-02-17 07:31:44 UTC

Is there any specific further information on the issue in tcpcrypt available?

Comment 5 msiddiqu 2019-02-18 09:10:37 UTC

Reference:

https://community.helpsystems.com/knowledge-base/fox-technologies/hotfix/515/ 

Unfortunately, apart from this, we don't have any additional information about the issue.

Comment 6 Salvatore Bonaccorso 2019-02-18 14:35:45 UTC

Hi,

(In reply to msiddiqu from comment #5)
> Reference:
> 
> https://community.helpsystems.com/knowledge-base/fox-technologies/hotfix/515/
> 
> 
> Unfortunately, apart from this, we don't have any additional information
> about the issue.


Thank you. I did not found any corresponding issue furthermore in the tcpcrypt fork on github.

Comment 7 Product Security DevOps Team 2019-06-10 10:47:48 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.