Red Hat Bugzilla – Bug 50335
telnetd segfaults during session negotiation
Last modified: 2007-04-18 12:35:17 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.2) Gecko/20010701
Description of problem:
telnetd crashes with SIG11 during telnet option negotiation. It may be
exploitable. I have tested telnet-server-0.17 release 7 and 10. I don't
have any RedHat 6.x boxes. See http://www.securityfocus.com/bid/3064
Steps to Reproduce:
1. perl -e 'print "\xff\xf6"x2000' | nc localhost telnet
Actual Results: telnetd recieves SIG11
*** Bug 50476 has been marked as a duplicate of this bug. ***
*** Bug 10860 has been marked as a duplicate of this bug. ***
Could you please retry with:
Bonus: security fixes to the recently discovered vulnerabilities
Seems that telnet-server-0.17-16.i386.rpm fixes the problem.
Thanks. When will be errata issued?
date of errata depends on the QA team..
Mental note: it might be good idea to disable IPv6 patches for errata releases,
just in case.
Exploit for telnet-0.17 was just released...
Thanks for *not publishing* the advisory :-]
Errata was published