Executive brief
A critical vulnerability exists in the telnet service, a tool used for remote terminal access to servers. An attacker can exploit this flaw to gain full administrative control (root access) over the affected system. This could lead to complete data theft, system destruction, or the use of the server for further attacks.
Technical details
The vulnerability is a classic buffer overflow located within the telnet daemon (telnetd). It is triggered during the processing of terminal capability information via the tgetent() function. By providing an oversized or maliciously crafted TERMCAP environmental variable during the connection handshake, a remote, unauthenticated attacker can overflow a stack-based buffer. This allows for the redirection of execution flow to arbitrary code, resulting in full system compromise with root privileges. This issue historically affected various Unix-like operating systems implementing standard telnet daemons.
Affected products
- unknown telnetd
Timeline
- 1997-10-18: disclosed: Initial publication date in NVD.