CVE-2001-0554

UNRATEDMemory safety

Exploit

Description

Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.

Affected products

debian / debian_linux2.2 – 2.2
FreeBSD / FreeBSD2.2 – 2.2
FreeBSD / FreeBSD2.0 – 2.0
FreeBSD / FreeBSD2.0.1 – 2.0.1
FreeBSD / FreeBSD2.0.5 – 2.0.5
FreeBSD / FreeBSD2.1 – 2.1
FreeBSD / FreeBSD2.1.0 – 2.1.0
FreeBSD / FreeBSD2.1.5 – 2.1.5
FreeBSD / FreeBSD2.1.6 – 2.1.6
FreeBSD / FreeBSD2.1.6.1 – 2.1.6.1
FreeBSD / FreeBSD2.1.7 – 2.1.7
FreeBSD / FreeBSD2.1.7.1 – 2.1.7.1
FreeBSD / FreeBSD2.2 – 2.2
FreeBSD / FreeBSD2.2.1 – 2.2.1
FreeBSD / FreeBSD2.2.2 – 2.2.2
FreeBSD / FreeBSD2.2.3 – 2.2.3
FreeBSD / FreeBSD2.2.4 – 2.2.4
FreeBSD / FreeBSD2.2.5 – 2.2.5
FreeBSD / FreeBSD2.2.6 – 2.2.6
FreeBSD / FreeBSD2.2.7 – 2.2.7
FreeBSD / FreeBSD2.2.8 – 2.2.8
FreeBSD / FreeBSD3.0 – 3.0
FreeBSD / FreeBSD3.0 – 3.0
FreeBSD / FreeBSD3.1 – 3.1
FreeBSD / FreeBSD3.2 – 3.2
FreeBSD / FreeBSD3.3 – 3.3
FreeBSD / FreeBSD3.4 – 3.4
FreeBSD / FreeBSD3.5 – 3.5
FreeBSD / FreeBSD3.5 – 3.5
FreeBSD / FreeBSD3.5.1 – 3.5.1
FreeBSD / FreeBSD3.5.1 – 3.5.1
FreeBSD / FreeBSD3.5.1 – 3.5.1
FreeBSD / FreeBSD4.0 – 4.0
FreeBSD / FreeBSD4.0 – 4.0
FreeBSD / FreeBSD4.0 – 4.0
FreeBSD / FreeBSD4.1 – 4.1
FreeBSD / FreeBSD4.1.1 – 4.1.1
FreeBSD / FreeBSD4.2 – 4.2
FreeBSD / FreeBSD4.3 – 4.3
ibm / aix4.3.1 – 4.3.1
ibm / aix5.1 – 5.1
ibm / aix4.3.3 – 4.3.3
ibm / aix4.3.2 – 4.3.2
ibm / aix4.3 – 4.3
MIT / kerberos1.0 – 1.0
MIT / Kerberos 51.1 – 1.1
MIT / Kerberos 51.1.1 – 1.1.1
MIT / Kerberos 51.2 – 1.2
MIT / Kerberos 51.2.1 – 1.2.1
MIT / Kerberos 51.2.2 – 1.2.2
NetBSD / netbsd1.3.1 – 1.3.1
NetBSD / netbsd1.5.1 – 1.5.1
NetBSD / netbsd1.5 – 1.5
NetBSD / netbsd1.4.3 – 1.4.3
NetBSD / netbsd1.4.2 – 1.4.2
NetBSD / netbsd1.4.1 – 1.4.1
NetBSD / netbsd1.4 – 1.4
NetBSD / netbsd1.3.3 – 1.3.3
NetBSD / netbsd1.2.1 – 1.2.1
NetBSD / netbsd1.3 – 1.3
NetBSD / netbsd1.3.2 – 1.3.2
NetBSD / netbsd1.0 – 1.0
NetBSD / netbsd1.1 – 1.1
NetBSD / netbsd1.2 – 1.2
netkit / linux_netkit0.12 – 0.12
netkit / linux_netkit0.11 – 0.11
netkit / linux_netkit0.10 – 0.10
openbsd / OpenBSD2.4 – 2.4
openbsd / OpenBSD2.0 – 2.0
openbsd / OpenBSD2.1 – 2.1
openbsd / OpenBSD2.2 – 2.2
openbsd / OpenBSD2.3 – 2.3
openbsd / OpenBSD2.5 – 2.5
openbsd / OpenBSD2.6 – 2.6
openbsd / OpenBSD2.7 – 2.7
openbsd / OpenBSD2.8 – 2.8
sgi / irix6.5 – 6.5
sun / solaris2.6 – 2.6
sun / sunos5.8 – 5.8
sun / sunos5.7 – 5.7
sun / sunos5.5.1 – 5.5.1
sun / sunos5.5 – 5.5
sun / sunos5.4 – 5.4
sun / sunos5.3 – 5.3
sun / sunos5.0 – 5.0
sun / sunos5.2 – 5.2
sun / sunos5.1 – 5.1

Exploits & proofs of concept

exploit-dbSolaris 2.x/7.0/8 / IRIX 6.5.x / OpenBSD 2.x / NetBSD 1.x / Debian 3 / HP-UX 10 - 'TelnetD' Remote Buffer Overflowby Dvorak

References

Updated 47m ago · 8 sources