Description
Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Solaris 2.x/7.0/8 / IRIX 6.5.x / OpenBSD 2.x / NetBSD 1.x / Debian 3 / HP-UX 10 - 'TelnetD' Remote Buffer Overflow EDB-21018 · remote · Jul 18, 2001 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- CLA-2001:413 vendor-advisory
- MDKSA-2001:068 vendor-advisory
- L-131 third-party-advisory government-resource
- SSRT0745U vendor-advisory
- telnetd-option-telrcv-bo(6875) vdb-entry
- 809 vdb-entry
- MSS-OAR-E01-2001:298 vendor-advisory
- 20010725 Telnetd AYT overflow scanner mailing-list
- 20010810 ADV/EXP: netkit <=0.17 in.telnetd remote buffer overflow mailing-list
- 3064 vdb-entry
- RHSA-2001:100 vendor-advisory
- SuSE-SA:2001:029 vendor-advisory
- RHSA-2001:099 vendor-advisory
- 20020129 Cisco CatOS Telnet Buffer Vulnerability vendor-advisory
- HPSBUX0110-172 vendor-advisory
- DSA-075 vendor-advisory
- 20010718 multiple vendor telnet daemon vulnerability mailing-list
- CA-2001-21 third-party-advisory
- CSSA-2001-030.0 vendor-advisory
- DSA-070 vendor-advisory
- 20010725 SCO - Telnetd AYT overflow ? mailing-list