Bugzilla Bug 64632

This vulnerability has been published in 2001 but does not seem to be fixed in
the current ebuild:

CVE-2001-0554:
"Buffer overflow in BSD-based telnetd telnet daemon on various operating
systems allows remote attackers to execute arbitrary commands via a set of
options including AYT (Are You There), which is not properly handled by the
telrcv function."

http://www.securityfocus.com/bid/3064
(especially:
http://www.securityfocus.com/archive/1/203000/2004-09-16/2004-09-22/2 )

RH and Debian seem to have substituted netoprintf()
_____________________________________________________________________________
And a Debian bug report from August:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=264846

[...]
Although this should never actually happen, if you set your environment
variable HOME to an extremely large string a buffer overflow will occur upon
connecting to a server using telnet.  I was not able to overwrite 'eip'
but I have included a patch that fixes this problem.
[...]

This has been patched in the latest Debian release.

Created an attachment (id=39916) [details]
Debian patchset

Full set of patches to orig from Debian

the first vulnerability seems to be addressed by a new netoprintf()
which is patched into ext.h and utility.c afaict

Created an attachment (id=39917) [details]
one of the RH patches

RH uses a new function instead of netoprintf() too

btw... the RH set of patches consist of 7 files in total, someone might want to
check what else is getting patched there when there is time

seemant you committed the last ebuild and there is no metadata.xml. Please
confirm and apply the patch as necessary.

Ok.. this is not a fun one to solve here.

Patch #2 (RH) makes things simple but I'm seeing what could be format string problems all over the place.

Patch #1 (DEB) is clearly superior to what we have in portage but fails to even compile for me using a modern compiler.
----------------------------------------------------------------------------------
Requesting assistance from our gcc-porting team. 

gcc-porting can you please look into making patch #1 (DEB) work on a gentoo ASAP so this security bug can be resolved.
- thanks in advance

gcc-porting/solar, did you have any luck in figuring this out yet?

Since one of the vulnerabilities is pretty old and not a light one, it would be good to have it patched soon.

hi,
try the following:

--start-patch--

diff -Naur ./netkit-telnet-0.17_orig/telnetd/utility.c ./netkit-telnet-0.17/telnetd/utility.c
--- ./netkit-telnet-0.17_orig/telnetd/utility.c	2004-09-24 17:49:10.728813640 +0200
+++ ./netkit-telnet-0.17/telnetd/utility.c	2004-09-24 17:50:19.837307552 +0200
@@ -37,6 +37,9 @@
 char util_rcsid[] = 
   "$Id: utility.c,v 1.11 1999/12/12 14:59:45 dholland Exp $";
 
+#define _GNU_SOURCE
+#include <stdio.h>
+
 #define PRINTOPTIONS
 
 #include <stdarg.h>

--end-patch--

unfortunately this funct() isn't documented... ;-)
so i'm not sure, if it will compile on all glibc versions out there...
best regards
rootshell

Created an attachment (id=40532) [details]
fixed debian patch

hi,
as solar said:
the debian patch is 'clearly superior' to what's currently in portage.
so i left most of it in.
in fact, i removed only debian specific stuff.
compiler fix is already included.

according to Changelog:
...
  05 Apr 2002; G.Bevin <gbevin@gentoo.org> netkit-telnetd-0.17-r2.ebuil,
  files/netkit-telnetd-0.17-gentoo.patch files/digest-netkit-telnetd-0.17-r2 :
  
  Global fixes to makefile inclusion and library linkage to make it compile
  with gcc3.
...

...the current gentoo.patch is now unneeded with this modified debian patch.

so please test, stabilize, report bugs - as always... ;-)

best regards
florian

seems to compile and work when changing

-DLOGIN_WRAPPER=\"/usr/lib/telnetlogin\" to         -DLOGIN_WRAPPER=\"/usr/sbin/telnetlogin\"

in the patch

Although I'm not sure if it is wise to apply such a big patch, which includes more than just fixes to the vulnerability. This package is definately missing a maintainer.

Created an attachment (id=40748) [details]
telnetd/Makefile patch

add this patch to solar's -r4 ebuild using the big debian patch and gcc3.4 will
be happy

Thanks. 

netkit-telnetd-0.17-r4.ebuild added to the tree. 

KEYWORDS="~x86 ~ppc ~sparc ~mips ~alpha ~hppa ~amd64 ~ppc64"

We now pull patch source directly from http://ftp.debian.org/debian/pool/main/n/netkit-telnet/netkit-telnet_0.17-26.diff.gz
With 1 additional patch provided from comment #8 and comment #9
I skipped the patch from comment #7 (thanks anyway)

Installed package data appears as (FEATURES="nodoc noinfo")
-------------------------------------------------------------------------------
/usr/bin/telnet
/usr/sbin/telnetd
/usr/sbin/in.telnetd
/usr/sbin/telnetlogin
/usr/share/man/man1/telnet.1.gz
/usr/share/man/man8/telnetd.8.gz
/usr/share/man/man8/in.telnetd.8.gz
/usr/share/man/man8/telnetlogin.8.gz
/usr/share/man/man5/issue.net.5.gz
/etc/xinetd.d/telnetd
-------------------------------------------------------------------------------
I've added a metadata.xml and added myself as the interim maintainer.
If anybody else want's this please by all means assume it.

As this is has many changes I suggest you test it well before marking stable on any arches.

Arches, please test carefullly and mark stable.

solar, since the ebuild does "dosbin telnetlogin/telnetlogin || die", the patch
should have 
-DLOGIN_WRAPPER=\"/usr/sbin/telnetlogin\"
instead of
-DLOGIN_WRAPPER=\"/usr/lib/telnetlogin\

otherwise you would have to specify the login programm with the -L option to
telnetd

ack, that's what i've seen testing here, telnetd won't work out of the box
otherwise.

Created an attachment (id=40779) [details]
slightly patched patch ;-)

new patch wrt comment #12

going back to ebuild status
sorry for the noise, but we will be back ;-)

Created an attachment (id=40781) [details]
security only patch

hi,
as the debian patch not only introduces security fixes, but also has many new
(and cool) features, i have attached a patch, that fixes _only_ the security
issues.
i have derived the patch from the slackware ayt patch, gentoo patch is
included, home problem also fixed.
(without new features) !!!
so eventually you want this patch mark stable for a month or so, then bump to
the debianized version.
one personal note:
if gentoo decides to adopt the debian patchset, it would be good practice, to
ask the current debian maintainer... ;-)
there are about 2 years of work in this patch...

best regards
florian [rootshell]

Could someone please have a look at comments 12, 13, 14 and correct the patch?

update patch from comment #14 - skipping patch form comment #16 as I'm not
interested in having a limping along telnetd. 

Normally we don't add features and secuirty patches at the same time. 
But seeing as this package has no maintainer and I've accepted being the temp
maintainer this is how I just assume maintain this package. 
I'd rather be taking advantage of those two years of QA, security fixes and
features deb has put into it.

Thanks anyway for patch from comment #16 
If however problems arise while stabilizing this one then one of the arch dev
can try your patch, but he/she will have to accept becoming the maintainer of
this ebuild.

Back to business...
Arches: please test carefully and eventually mark stable.

stabke on ppc

Stable on alpha.

stable on sparc.

Stable on mips.

stable on x86

Debian just issued : http://www.debian.org/security/2004/dsa-556

"Michal Zalewski discovered a bug in the netkit-telnet server (telnetd) whereby a remote attacker could cause the telnetd process to free an invalid pointer. This causes the telnet server process to crash, leading to a straightforward denial of service (inetd will disable the service if telnetd is crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user)."

This is CAN-2004-0911.
Apparently what we use (0.17-26) should have the fix in, please doublecheck.

http://packages.qa.debian.org/n/netkit-telnet.html

It appears that the latest vulnerability (comment #25) is Debian specific and
was introduced by their earlier patches.
Since we used -26 right away, we were not vulnerable to this one.

I guess there were "just" the AYT and HOME buffer overflows for us.

stable on amd64

Generating MCONFIG...
(cd  telnet && make)
make[1]: Entering directory `/mnt/portage/tmp/portage/netkit-telnetd-0.17-r4/work/netkit-telnet-0.17/telnet'
g++ -march=i686 -O3 -march=i686 -O3 -pipe -fno-rtti -fno-exceptions -Wall -Wno-trigraphs  -DUSE_TERMIO -DKLUDGELINEMODE commands.cc -c
commands.cc: In function `void cmdrc(const char *, const char *, const char *)':
commands.cc:2147: implicit declaration of function `int asprintf(...)'
make[1]: *** [commands.o] Error 1
make[1]: Leaving directory `/mnt/portage/tmp/portage/netkit-telnetd-0.17-r4/work/netkit-telnet-0.17/telnet'
make: *** [telnet.build] Error 2

!!! ERROR: net-misc/netkit-telnetd-0.17-r4 failed.
!!! Function src_compile, Line 51, Exitcode 2
!!! (no error message)

Portage 2.0.50-r11 (default-1.0, gcc-2.95.3, glibc-2.2.5-r9, 2.6.7-gentoo-r14)

0.17-r3 installed successfuly so it has to be something with this new patch

GLSA 200410-03
hppa, ppc64, don't forget to mark stable to benefit from GLSA.

stable on ppc64, thanks!

solar@simple netkit-telnetd $ date -u
Mon Nov  1 21:35:59 UTC 2004

solar@simple netkit-telnetd $ cvs diff netkit-telnetd-0.17-r4.ebuild

solar@simple netkit-telnetd $ diff -rup netkit-telnetd-0.17-r3.ebuild netkit-telnetd-0.17-r4.ebuild
--- netkit-telnetd-0.17-r3.ebuild	2004-11-01 16:32:50.000000000 -0500
+++ netkit-telnetd-0.17-r4.ebuild	2004-11-01 16:32:50.000000000 -0500
@@ -1,16 +1,18 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/net-misc/netkit-telnetd/netkit-telnetd-0.17-r3.ebuild,v 1.25 2004/06/29 00:16:46 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/net-misc/netkit-telnetd/netkit-telnetd-0.17-r4.ebuild,v 1.8 2004/10/06 15:37:55 gmsoft Exp $
 
 inherit eutils
 
+PATCHLEVEL=26
 DESCRIPTION="Standard Linux telnet client and server"
 HOMEPAGE="ftp://ftp.uk.linux.org/pub/linux/Networking/netkit/"
-SRC_URI="ftp://ftp.uk.linux.org/pub/linux/Networking/netkit/netkit-telnet-${PV}.tar.gz"
+SRC_URI="ftp://ftp.uk.linux.org/pub/linux/Networking/netkit/netkit-telnet-${PV}.tar.gz
+	http://ftp.debian.org/debian/pool/main/n/netkit-telnet/netkit-telnet_0.17-${PATCHLEVEL}.diff.gz"
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="x86 ppc sparc mips alpha hppa amd64 ppc64"
+KEYWORDS="x86 ppc sparc mips alpha hppa amd64 ~ppc64"
 IUSE="build"
 
 DEPEND=">=sys-libs/ncurses-5.2
@@ -21,7 +23,21 @@ S=${WORKDIR}/netkit-telnet-${PV}
 src_unpack() {
 	unpack ${A}
 	cd ${S}
-	epatch ${FILESDIR}/netkit-telnetd-0.17-gentoo.patch
+	# Patch: [0]
+	# Gentoo lacks a maintainer for this package right now. And a 
+	# security problem arose. While reviewing our options for how 
+	# should we proceed with the security bug we decided it would be 
+	# better to just stay in sync with debian's own netkit-telnet 
+	# package. Lots of bug fixes by them over time which were not in 
+	# our telnetd.
+	epatch ${WORKDIR}/netkit-telnet_0.17-${PATCHLEVEL}.diff || die
+
+	# Patch: [1]
+	# after the deb patch we need to add a small patch that defines 
+	# gnu source. This is needed for gcc-3.4.x (needs to be pushed 
+	# back to the deb folk?)
+	epatch ${FILESDIR}/netkit-telnetd-0.17-cflags-gnu_source.patch \
+		|| die
 }
 
 src_compile() {

solar@simple netkit-telnetd $ grep KEYWORDS= *
netkit-telnetd-0.17-r3.ebuild:KEYWORDS="x86 ppc sparc mips alpha hppa amd64 ppc64"
netkit-telnetd-0.17-r4.ebuild:KEYWORDS="x86 ppc sparc mips alpha hppa amd64 ~ppc64"

---------------------------------------------------------
ppc64 is not stable revision is 1.8 and never could have been.
1.1 iniital ebuild
1.2 x86
1.3 ppc
1.4 sparc
1.5 mips
1.6 alpha
1.7 hppa
1.8 amd64
(1.2 - 1.8 are out of order but..)

ppc64 - Please mark -r4 stable I have to add a small update to add for gcc-2.x from bug #68679

tested and commited on ppc64.

Markus

Closing again :)

removing ppc64 from cc list