Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Debian 3.0 Woody: DSA 556-2 Critical: Netkit-Telnet Remote DoS

debian
Calendar Grey October 18, 2004
Debian Logo
Urgent Debian notification concerning netkit-telnet related to a remote denial-of-service vulnerability. Upgrade is advised.
Michal Zalewski discovered a bug in the netkit-telnet server (telnetd) whereby a remote attacker could cause the telnetd process to free an invalid pointer.

Summary

This is an update for DSA 556-1 which was intended to fix a denial of
service situation in netkit-telnet but didn't. The update for
unstable did fix the problem. For completeness below is the original
advisory text:

Michal Zalewski discovered a bug in the netkit-telnet server (telnetd)
whereby a remote attacker could cause the telnetd process to free an
invalid pointer. This causes the telnet server process to crash,
leading to a straightforward denial of service (inetd will disable the
service if telnetd is crashed repeatedly), or possibly the execution
of arbitrary code with the privileges of the telnetd process (by
default, the 'telnetd' user).

For the unstable distribution (sid) this problem has been fixed in
version 0.17-26.

For the stable distribution (woody) this problem has been fixed in
version 0.17-18woody2.

We recommend that you upgrade your netkit-telnet-ssl package.


Upgrade Instructions
--------------------

wget url
will fetch the file for you
dpkg -i file.deb
...

Read the Full Advisory

Severity
critical
Lowest
Low
Medium
High
Critical

Package: netkit-telnet
CVE ID: CAN-2004-0911

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here