Synopsis

telnet security update

Type/Severity

Security Advisory: Important

Topic

Updated telnet packages that fix two buffer overflow vulnerabilities are
now available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The telnet package provides a command line telnet client. The telnet-server
package includes a telnet daemon, telnetd, that supports remote login to
the host machine.

Two buffer overflow flaws were discovered in the way the telnet client
handles messages from a server. An attacker may be able to execute
arbitrary code on a victim's machine if the victim can be tricked into
connecting to a malicious telnet server. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the names CAN-2005-0468
and CAN-2005-0469 to these issues.

Additionally, the following bugs have been fixed in these erratum packages
for Red Hat Enterprise Linux 2.1 and Red Hat Enterprise Linux 3:

• telnetd could loop on an error in the child side process
  
• There was a race condition in telnetd on a wtmp lock on some occasions
  
• The command line in the process table was sometimes too long and caused
  bad output from the ps command
  
• The 8-bit binary option was not working
  

Users of telnet should upgrade to this updated package, which contains
backported patches to correct these issues.

Red Hat would like to thank iDEFENSE for their responsible disclosure of
this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 126858 - Too long /proc/X/cmdline: bad ps output when piped to less/more
• BZ - 145004 - telnetd cleanup() race condition with syslog in signal handler
• BZ - 145636 - [PATCH] telnetd loops on child IO error
• BZ - 147003 - [RHEL3] telnetd cleanup() race condition with syslog in signal handler
• BZ - 151297 - CAN-2005-0469 slc_add_reply() Buffer Overflow Vulnerability
• BZ - 151301 - CAN-2005-0468 env_opt_add() Buffer Overflow Vulnerability

CVEs

• CVE-2005-0469
• CVE-2005-0468

References

• http://www.idefense.com/application/poi/display?id=220&type=vulnerabilities
• http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities

Red Hat Enterprise Linux Server 4

SRPM
x86_64
telnet-0.17-31.EL4.2.x86_64.rpm	SHA-256: b3b94a470294d70d14260b79a296c03150fa032be8479e541b99f2f63c4082de
telnet-0.17-31.EL4.2.x86_64.rpm	SHA-256: b3b94a470294d70d14260b79a296c03150fa032be8479e541b99f2f63c4082de
telnet-server-0.17-31.EL4.2.x86_64.rpm	SHA-256: d2531cf16d75de14fda0bf3125ba75adcf4a08e15be6490eba905ee15913b7d7
telnet-server-0.17-31.EL4.2.x86_64.rpm	SHA-256: d2531cf16d75de14fda0bf3125ba75adcf4a08e15be6490eba905ee15913b7d7
ia64
telnet-0.17-31.EL4.2.ia64.rpm	SHA-256: 1c829241601d1ed3ab5a27e61ce160e4b8aed0001a9504697e92a3f9ec3a23fe
telnet-0.17-31.EL4.2.ia64.rpm	SHA-256: 1c829241601d1ed3ab5a27e61ce160e4b8aed0001a9504697e92a3f9ec3a23fe
telnet-server-0.17-31.EL4.2.ia64.rpm	SHA-256: 4fcda946ffa972893c4e58a11942a7c77233ad1d787e23027a335faf5ea8a853
telnet-server-0.17-31.EL4.2.ia64.rpm	SHA-256: 4fcda946ffa972893c4e58a11942a7c77233ad1d787e23027a335faf5ea8a853
i386
telnet-0.17-31.EL4.2.i386.rpm	SHA-256: c7a5d85ae324ff67af84b395f41a75cd065fd78b450772497f1a9a7035fc7d5d
telnet-0.17-31.EL4.2.i386.rpm	SHA-256: c7a5d85ae324ff67af84b395f41a75cd065fd78b450772497f1a9a7035fc7d5d
telnet-server-0.17-31.EL4.2.i386.rpm	SHA-256: 12844e687dd636665808428e2a7d196a41133980871892b2c6bc5018b1829e42
telnet-server-0.17-31.EL4.2.i386.rpm	SHA-256: 12844e687dd636665808428e2a7d196a41133980871892b2c6bc5018b1829e42

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
telnet-0.17-31.EL4.2.x86_64.rpm	SHA-256: b3b94a470294d70d14260b79a296c03150fa032be8479e541b99f2f63c4082de
telnet-server-0.17-31.EL4.2.x86_64.rpm	SHA-256: d2531cf16d75de14fda0bf3125ba75adcf4a08e15be6490eba905ee15913b7d7
ia64
telnet-0.17-31.EL4.2.ia64.rpm	SHA-256: 1c829241601d1ed3ab5a27e61ce160e4b8aed0001a9504697e92a3f9ec3a23fe
telnet-server-0.17-31.EL4.2.ia64.rpm	SHA-256: 4fcda946ffa972893c4e58a11942a7c77233ad1d787e23027a335faf5ea8a853
i386
telnet-0.17-31.EL4.2.i386.rpm	SHA-256: c7a5d85ae324ff67af84b395f41a75cd065fd78b450772497f1a9a7035fc7d5d
telnet-server-0.17-31.EL4.2.i386.rpm	SHA-256: 12844e687dd636665808428e2a7d196a41133980871892b2c6bc5018b1829e42

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
telnet-0.17-31.EL4.2.x86_64.rpm	SHA-256: b3b94a470294d70d14260b79a296c03150fa032be8479e541b99f2f63c4082de
telnet-server-0.17-31.EL4.2.x86_64.rpm	SHA-256: d2531cf16d75de14fda0bf3125ba75adcf4a08e15be6490eba905ee15913b7d7
i386
telnet-0.17-31.EL4.2.i386.rpm	SHA-256: c7a5d85ae324ff67af84b395f41a75cd065fd78b450772497f1a9a7035fc7d5d
telnet-server-0.17-31.EL4.2.i386.rpm	SHA-256: 12844e687dd636665808428e2a7d196a41133980871892b2c6bc5018b1829e42

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
telnet-0.17-31.EL4.2.s390x.rpm	SHA-256: 2be03170685d5c3fc2bfc371f37cc7d97f201225f73ad5334de6220cf3ebccf7
telnet-server-0.17-31.EL4.2.s390x.rpm	SHA-256: b472b1239571094752098448e34595b14d553d7d59fe38e7ef443ac072dcefcb
s390
telnet-0.17-31.EL4.2.s390.rpm	SHA-256: cdbd89387551f0a57ee28ed34c18cd494592f564a3aacd878c4ff51d04c181b9
telnet-server-0.17-31.EL4.2.s390.rpm	SHA-256: 03f846c2b37b76c640d3a66827f7d5c9438577791d0ce6f1c4d3df23433d1324

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
telnet-0.17-31.EL4.2.ppc.rpm	SHA-256: 4ab1191a8da25679dde22a47d3aedab0f1cea1ec09a66bbbcf01c281a6fd3f9f
telnet-server-0.17-31.EL4.2.ppc.rpm	SHA-256: 3a3f652e290fa633f2258fa10ac3587f7a78be85bd0ee1f74891248400b5768a