|
Kerberos V5 Telnet Client Information Disclosure Weakness
|
|
|
|
|
Secunia Advisory:
|
SA15709
|
|
|
Release Date:
|
2005-06-15
|
|
|
Critical:
|
Not critical
|
|
Impact:
|
Exposure of system information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Kerberos 5.x
|
| | CVE reference: | CVE-2005-0488 (Secunia mirror)
|
|
|
This advisory is currently marked as unpatched!
- Companies can be alerted when a patch is released! |
|
|
Description:
Gaël Delalleau has reported a weakness in Kerberos V5, which can be exploited by malicious people to gain knowledge of various information.
The problem is caused due to a design error in the Telnet client when handling the NEW-ENVIRON command. This can be exploited to gain knowledge of the session variables for a user, who has an open connection to a malicious Telnet server.
The weakness has been reported in the telnet client included in the Kerberos V5 Release 1.3.6 package. Other versions may also be affected.
Solution:
The vendor is reportedly considering to release patches, which implement an option to restrict or disable the transmission of environment variables by the telnet client.
Provided and/or discovered by:
Gaël Delalleau
Original Advisory:
iDEFENSE:
http://www.idefense.com/application/poi/display?id=260&type=vulnerabilities
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
19 Related Secunia Security Advisories, displaying 10
|
|
|
1. Kerberos Multiple Vulnerabilities
|
|
2. Kerberos Multiple Vulnerabilities
|
|
3. Kerberos Multiple Vulnerabilities
|
|
4. Kerberos Multiple Vulnerabilities
|
|
5. Kerberos kadmind xprt->xp_auth Code Execution Vulnerability
|
|
6. Kerberos kadmind "mechglue" Code Execution Vulnerability
|
|
7. Kerberos V5 setuid Security Issue
|
|
8. Kerberos V5 Multiple Vulnerabilities
|
|
9. MIT Kerberos Telnet Client Buffer Overflow Vulnerabilities
|
|
10. Kerberos V5 "libkadm5srv" Buffer Overflow Vulnerability
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
