NetBSD Security Advisory 2000-017 - Kerberised telnetd and libkrb contain exploitable local root bugs. There were two problems - first, telnetd allowed the user to provide arbitrary environment variables, including several that cause programs to behave differently. There was also a possible buffer overflow in the Kerberos v4 library.
e2ca278f746dd9a252a1141d30648c61f4059f12835a666a65c72466f7ff53b7
-----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2000-017
=================================
Topic: Exploitable bugs in kerberised telnetd and libkrb
Version: 1.5
Severity: local root compromise possible
Fixed: 2000/12/09 in -current; 2000/12/15 in netbsd-1-5-branch
Abstract
========
The combination of a too liberal implementation in telnetd and bugs in
libkrb combines to make it possible for authorized users of a system
to obtain root access on a system.
Technical Details
=================
there were two problems; first, telnetd allowed the user to provide
arbitrary environment variables, including several that cause programs
to behave differently. There was also a possible buffer overflow in
the kerberos v4 library.
Solutions and Workarounds
=========================
The problem was fixed in NetBSD-current on 2000/12/09; systems running
NetBSD-current dated from before that date should be upgraded to
NetBSD-current dated 2000/12/09 or later. The 1.5 branch was
fixed by 2000/12/15.
Systems running 1.4.x are not vulnerable to this problem as they do
not contain this version of kerberos.
Systems running 1.5 should apply the patch found in
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-krb
and then rebuild and reinstall both the "libkrb" library and telnetd.
Systems running NetBSD-current dated from before 2000/12/09 should be
upgraded to NetBSD-current dated 2000/12/09 or later.
Thanks To
=========
Jouko Pynnönen <jouko@solutions.fi>
Revision History
================
20001215 First draft
More Information
================
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.
Copyright 2000, The NetBSD Foundation, Inc. All Rights Reserved.
$NetBSD: NetBSD-SA2000-017.txt,v 1.5 2000/12/20 20:30:13 sommerfeld Exp $
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQCVAwUBOkEW3j5Ru2/4N2IFAQHOmwP8D/+PSPdMwwo4G22IX2820iRitmUBU7c/
moB6TaEw9CPMzAmd3499Kx/Xe+IRMFEFgDZOJVDZx/tgqWR2Xpd/caQiAM/9c0Th
uVRW/A5EgSm7mUnUk82KHnySpqKn+Cnr1ytR9a+HuaSpn0O/Q0yHslg95G+VYQ2W
f31W26+Q21M=
=hboe
-----END PGP SIGNATURE-----