Product
Sun Enterprise Authentication Mechanism 1.0

Bug Id
6248576

Date of Workaround Release
07-APR-2005

Date of Resolved Release
14-JUN-2005

Impact

There is a buffer overflow in the unprivileged kerberized telnet(1) utility of Sun Enterprise Authentication Mechanism (SEAM) Software for Solaris. This is not a security vulnerability on its own. However, kerberized telnet(1) communicates with another host using the TELNET protocol and thus there is a small risk of a remote user successfully exploiting the overflow.

If a remote unprivileged user is able to cause a user to execute the kerberized telnet(1) utility on their client system, then that remote user may be able to execute arbitrary commands on the client system with the privileges of the user who executed kerberized telnet(1). The remote user may also be able to read the values of arbitrary shell environment variables of the user who executed telnet(1).

Sun acknowledges with thanks, iDEFENSE (http://www.idefense.com), for bringing these issues to our attention. These issues are also referenced in the following iDEFENSE documents:

IDEF0865 - Multiple Vendor Telnet Client Information Disclosure Vulnerability at http://www.idefense.com/application/poi/display?id=260

IDEF0866 - Multiple Telnet Client slc_add_reply() Buffer Overflow at http://www.idefense.com/application/poi/display?id=220

IDEF0867 - Multiple Telnet Client env_opt_add() Buffer Overflow at http://www.idefense.com/application/poi/display?id=221

These issues are also described in the following CAN documents:

CAN-2005-0468 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0468

CAN-2005-0469 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0469

CAN-2005-0488 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0488

These issues are also described in the following CERT Vulnerability Notes:

VU#291924 at http://www.kb.cert.org/vuls/id/291924

VU#341908 at http://www.kb.cert.org/vuls/id/341908

VU#800829 at http://www.kb.cert.org/vuls/id/800829

Contributing Factors

These issues can occur in the following releases:

SPARC Platform

• SEAM 1.0 (for Solaris 7) without patch 110057-08
• SEAM 1.0.1 (for Solaris 8) without patch 110060-19
• SEAM 1.0.2 (for Solaris 9) without patch 116462-04

x86 Platform

• SEAM 1.0 (for Solaris 7) without patch 110058-08
• SEAM 1.0.1 (for Solaris 8) without patch 110061-18
• SEAM 1.0.2 (for Solaris 9) without patch 119796-02

Notes:

1. Solaris Enterprise Authentication Mechanism (SEAM) is an unbundled product available for Solaris 7, 8 and 9. For more information on SEAM, please see the SEAM(5) man page.
2. For Solaris without SEAM, see Sun Alert 57755.
3. There is no unbundled SEAM product for Solaris 10. For systems configured to use Kerberized telnet in Solaris 10, also see Sun Alert 57755.

Symptoms

There are no predictable symptoms that would indicate the described issues have been exploited.

Workaround

To work around the described issues until patches can be installed, sites may consider removing the execute permissions from the kerberized telnet(1) utility. To accomplish this, the following command can be run (as "root"):

# chmod 000 /usr/krb5/bin/telnet

To restore the original permissions to the telnet(1) utility (after the patches have been applied) the following command can be run (as "root"):

# chmod 555 /usr/krb5/bin/telnet

Resolution

These issues are addressed in the following releases:

SPARC Platform

• SEAM 1.0 (for Solaris 7) with patch 110057-08 or later
• SEAM 1.0.1 (for Solaris 8) with patch 110060-19 or later
• SEAM 1.0.2 (for Solaris 9) with patch 116462-04 or later

x86 Platform

• SEAM 1.0 (for Solaris 7) with patch 110058-08 or later
• SEAM 1.0.1 (for Solaris 8) with patch 110061-18 or later
• SEAM 1.0.2 (for Solaris 9) with patch 119796-02 or later

Modification History
Date: 29-APR-2005

• Pending patches added, tentatively to be released first week of May

Date: 13-JUN-2005

Change History:

11-Jun-2005:

• Updated with new information in "Impact" section to additionally include the new information on CAN-2005-0468 / IDEF0865 which is also resolved by the patches listed in this Sun Alert.

References

116462-03
119796-01
110057-08
110058-08
110060-18
110061-17




Attachments

This solution has no attachment