Bug 50335

Summary:	telnetd segfaults during session negotiation
Product:	[Retired] Red Hat Linux	Reporter:	Need Real Name <bendik>
Component:	telnet	Assignee:	Harald Hoyer <harald>
Status:	CLOSED ERRATA	QA Contact:	David Lawrence <dkl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.1	CC:	laurence, pekkas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2001-08-09 17:55:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Need Real Name 2001-07-30 15:49:23 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.2) Gecko/20010701

Description of problem:
telnetd crashes with SIG11 during telnet option negotiation. It may be
exploitable. I have tested telnet-server-0.17 release 7 and 10. I don't
have any RedHat 6.x boxes. See http://www.securityfocus.com/bid/3064

How reproducible:
Always

Steps to Reproduce:
1. perl -e 'print "\xff\xf6"x2000' | nc localhost telnet
2.
3.
	

Actual Results:  telnetd recieves SIG11

Additional info:

Comment 1 Harald Hoyer 2001-07-30 15:54:53 UTC

thx

Comment 2 Harald Hoyer 2001-07-31 15:53:31 UTC

*** Bug 50476 has been marked as a duplicate of this bug. ***

Comment 3 Harald Hoyer 2001-08-01 06:42:11 UTC

*** Bug 10860 has been marked as a duplicate of this bug. ***

Comment 4 Harald Hoyer 2001-08-01 06:48:43 UTC

Could you please retry with:
ftp://people.redhat.com/harald/telnet-0.17-16.src.rpm
ftp://people.redhat.com/harald/telnet-0.17-16.i386.rpm
ftp://people.redhat.com/harald/telnet-server-0.17-16.i386.rpm
Bonus: security fixes to the recently discovered vulnerabilities

Comment 5 Need Real Name 2001-08-01 07:32:40 UTC

Seems that telnet-server-0.17-16.i386.rpm fixes the problem.
Thanks. When will be errata issued?

Comment 6 Harald Hoyer 2001-08-01 07:36:06 UTC

date of errata depends on the QA team..

Comment 7 Pekka Savola 2001-08-01 11:43:01 UTC

Mental note: it might be good idea to disable IPv6 patches for errata releases,
just in case.

Comment 8 Need Real Name 2001-08-09 17:55:25 UTC

Exploit for telnet-0.17 was just released...
Thanks for *not publishing* the advisory :-]

--rado b

Comment 9 Harald Hoyer 2001-08-22 10:14:01 UTC

Errata was published