From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.2) Gecko/20010701 Description of problem: telnetd crashes with SIG11 during telnet option negotiation. It may be exploitable. I have tested telnet-server-0.17 release 7 and 10. I don't have any RedHat 6.x boxes. See http://www.securityfocus.com/bid/3064 How reproducible: Always Steps to Reproduce: 1. perl -e 'print "\xff\xf6"x2000' | nc localhost telnet 2. 3. Actual Results: telnetd recieves SIG11 Additional info:
thx
*** Bug 50476 has been marked as a duplicate of this bug. ***
*** Bug 10860 has been marked as a duplicate of this bug. ***
Could you please retry with: ftp://people.redhat.com/harald/telnet-0.17-16.src.rpm ftp://people.redhat.com/harald/telnet-0.17-16.i386.rpm ftp://people.redhat.com/harald/telnet-server-0.17-16.i386.rpm Bonus: security fixes to the recently discovered vulnerabilities
Seems that telnet-server-0.17-16.i386.rpm fixes the problem. Thanks. When will be errata issued?
date of errata depends on the QA team..
Mental note: it might be good idea to disable IPv6 patches for errata releases, just in case.
Exploit for telnet-0.17 was just released... Thanks for *not publishing* the advisory :-] --rado b
Errata was published