topic Re: Telnet Daemon TERMCAP check in Operating System - HP-UX

Telnet Daemon TERMCAP check

Printaporn_1 — Thu, 16 Aug 2001 06:48:48 GMT

I am using HP-UX 11.0
for security auditing with cybercop , following is high risk result:

Description: This module determines whether the remote telnet daemon is vulnerable
to a buffer overflow attack in the tgetent library routine when parsing
a terminal capability file. By uploading an alternate TERMCAP file,
an attacker can specify the path to this file and cause the telnet
daemon to execute arbitrary commands.
Security Concerns: Remote attackers can obtain superuser access remotely by connecting
to the telnet daemon.
Suggestion: Affected vendors have released patches for this problem. If your
system is found to be vulnerable to this attack, contact your operating
system vendor for a patch or upgrade to a more recent release.
Additionally, upgrading to a version of libtermcap more recent than
2.0.8 or to a telnet daemon that relies on ncurses will eliminate this
vulnerability.
------------------

by the way I already install the latested telnet patch and cannot find any patch to resolved this risk.

please advise,
thanks

Re: Telnet Daemon TERMCAP check

harry d brown jr — Thu, 16 Aug 2001 11:52:37 GMT

This is not a risk on HPux 11.xx

Re: Telnet Daemon TERMCAP check

Manuel P. Ron — Fri, 17 Aug 2001 05:23:13 GMT

Secure your telnet daemon allowing only incoming sessions from local networt (edit /var/adm/inetd.sec file). And monitorize logins and bad logins connections using last and lastb commands. Look permissions at /var/adm/bmtp and /var/adm/wtmp files.

Re: Telnet Daemon TERMCAP check

Ralf Hildebrandt — Fri, 17 Aug 2001 10:38:31 GMT

telnetd is per se a security risk:
http://www.securityportal.com/cover/coverstory20000814.html

Disable it, and also tighten security by using tcp_wrappers.

Re: Telnet Daemon TERMCAP check

Brian Markus — Thu, 13 Sep 2001 15:42:56 GMT

Telnet by nature sends plain text through the network, which is sniffable, there are numerous other problems with telnet besides this. Try installing SSH or OpenSSH. It will provide you the same functionality with an encrypted data stream.
http://www.ssh.com
http://www.openssh.com

Hope this helps

Brian