National Cyber-Alert System

Vulnerability Summary for CVE-2005-0488

Overview

Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#800829

Name: VU#800829

Type: Advisory; Patch Information

Hyperlink:http://www.kb.cert.org/vuls/id/800829

US-CERT Technical Alert: TA06-214A

Name: TA06-214A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-214A.html

External Source: SUNALERT

Name: 57761

Type: Advisory; Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-57761-1

External Source: SUNALERT

Name: 57755

Type: Advisory; Patch Information

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-57755-1

External Source: REDHAT

Name: RHSA-2005:504

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-504.html

External Source: SUSE

Name: SUSE-SR:2005:016

Hyperlink:http://www.novell.com/linux/security/advisories/2005_16_sr.html

External Source: IDEFENSE

Name: 20050614 Multiple Vendor Telnet Client Information Disclosure Vulnerability

Type: Advisory

Hyperlink:http://idefense.com/application/poi/display?id=260&type=vulnerabilities

External Source: BID

Name: 19289

Hyperlink:http://www.securityfocus.com/bid/19289

External Source: BID

Name: 13940

Hyperlink:http://www.securityfocus.com/bid/13940

External Source: REDHAT

Name: RHSA-2005:562

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-562.html

External Source: VUPEN

Name: ADV-2006-3101

Hyperlink:http://www.frsirt.com/english/advisories/2006/3101

External Source: SUNALERT

Name: 101671

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101671-1

External Source: SUNALERT

Name: 101665

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101665-1

External Source: SECTRACK

Name: 1014203

Hyperlink:http://securitytracker.com/id?1014203

External Source: SECUNIA

Name: 21253

Hyperlink:http://secunia.com/advisories/21253

External Source: SECUNIA

Name: 17135

Hyperlink:http://secunia.com/advisories/17135

External Source: APPLE

Name: APPLE-SA-2006-08-01

Hyperlink:http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html

US Government Resource: oval:org.mitre.oval:def:1139

Name: oval:org.mitre.oval:def:1139

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1139