CVE-2001-0554

Published: Aug 14, 2001Modified: Apr 16, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.

Affected (87)

Products: Mit: Kerberos, Kerberos 5 · Netkit: Linux Netkit · Sgi: Irix · +6 more

Show all products

Mit: Kerberos, Kerberos 5 · Netkit: Linux Netkit · Sgi: Irix · Freebsd: Freebsd · Ibm: Aix · Netbsd: Netbsd · Openbsd: Openbsd · Sun: Solaris, Sunos · Debian: Debian Linux

2 products

1 product

1 product

1 product

1 product

1 product

1 product

2 products

1 product

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos	Version 1.0
Mit Kerberos 5	Version 1.1.1
Mit Kerberos 5	Version 1.1
Mit Kerberos 5	Version 1.2.1
Mit Kerberos 5	Version 1.2.2
Mit Kerberos 5	Version 1.2
Netkit Linux Netkit	Version 0.10
Netkit Linux Netkit	Version 0.11
Netkit Linux Netkit	Version 0.12
Sgi Irix	Version 6.5

Configuration B

76 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 2.0.1
Freebsd Freebsd	Version 2.0.5
Freebsd Freebsd	Version 2.0
Freebsd Freebsd	Version 2.1.0
Freebsd Freebsd	Version 2.1.5
Freebsd Freebsd	Version 2.1.6.1
Freebsd Freebsd	Version 2.1.6
Freebsd Freebsd	Version 2.1.7.1
Freebsd Freebsd	Version 2.1.7
Freebsd Freebsd	Version 2.1 stable
Freebsd Freebsd	Version 2.2.1
Freebsd Freebsd	Version 2.2.2
Freebsd Freebsd	Version 2.2.3
Freebsd Freebsd	Version 2.2.4
Freebsd Freebsd	Version 2.2.5
Freebsd Freebsd	Version 2.2.6
Freebsd Freebsd	Version 2.2.7
Freebsd Freebsd	Version 2.2.8
Freebsd Freebsd	Version 2.2
Freebsd Freebsd	Version 2.2 current
Freebsd Freebsd	Version 3.0
Freebsd Freebsd	Version 3.0 releng
Freebsd Freebsd	Version 3.1
Freebsd Freebsd	Version 3.2
Freebsd Freebsd	Version 3.3
Freebsd Freebsd	Version 3.4
Freebsd Freebsd	Version 3.5.1
Freebsd Freebsd	Version 3.5.1 release
Freebsd Freebsd	Version 3.5.1 stable
Freebsd Freebsd	Version 3.5
Freebsd Freebsd	Version 3.5 stable
Freebsd Freebsd	Version 4.0
Freebsd Freebsd	Version 4.0 alpha
Freebsd Freebsd	Version 4.0 releng
Freebsd Freebsd	Version 4.1.1
Freebsd Freebsd	Version 4.1
Freebsd Freebsd	Version 4.2
Freebsd Freebsd	Version 4.3
Ibm Aix	Version 4.3.1
Ibm Aix	Version 4.3.2
Ibm Aix	Version 4.3.3
Ibm Aix	Version 4.3
Ibm Aix	Version 5.1
Netbsd Netbsd	Version 1.0
Netbsd Netbsd	Version 1.1
Netbsd Netbsd	Version 1.2.1
Netbsd Netbsd	Version 1.2
Netbsd Netbsd	Version 1.3.1
Netbsd Netbsd	Version 1.3.2
Netbsd Netbsd	Version 1.3.3
Netbsd Netbsd	Version 1.3
Netbsd Netbsd	Version 1.4.1
Netbsd Netbsd	Version 1.4.2
Netbsd Netbsd	Version 1.4.3
Netbsd Netbsd	Version 1.4
Netbsd Netbsd	Version 1.5.1
Netbsd Netbsd	Version 1.5
Openbsd Openbsd	Version 2.0
Openbsd Openbsd	Version 2.1
Openbsd Openbsd	Version 2.2
Openbsd Openbsd	Version 2.3
Openbsd Openbsd	Version 2.4
Openbsd Openbsd	Version 2.5
Openbsd Openbsd	Version 2.6
Openbsd Openbsd	Version 2.7
Openbsd Openbsd	Version 2.8
Sun Solaris	Version 2.6
Sun Sunos	Version 5.0
Sun Sunos	Version 5.1
Sun Sunos	Version 5.2
Sun Sunos	Version 5.3
Sun Sunos	Version 5.4
Sun Sunos	Version 5.5.1
Sun Sunos	Version 5.5
Sun Sunos	Version 5.7
Sun Sunos	Version 5.8

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 2.2

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (50)

ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:49.telnetd.asc (unsafe URL)

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-012.txt.asc (unsafe URL)

Source: cve@mitre.org

Broken Link

ftp://patches.sgi.com/support/free/security/advisories/20010801-01-P (unsafe URL)

Source: cve@mitre.org

Broken Link

ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.10/CSSA-2001-SCO.10.txt (unsafe URL)

Source: cve@mitre.org

Broken Link

http://archives.neohapsis.com/archives/hp/2001-q4/0014.html

Source: cve@mitre.org

Broken Link

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000413

Source: cve@mitre.org

Broken Link

http://ftp.support.compaq.com/patches/.new/html/SSRT0745U.shtml

Source: cve@mitre.org

Broken Link

http://online.securityfocus.com/advisories/3476

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://online.securityfocus.com/archive/1/199496

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://online.securityfocus.com/archive/1/199541

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://online.securityfocus.com/archive/1/203000

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.calderasystems.com/support/security/advisories/CSSA-2001-030.0.txt

Source: cve@mitre.org

Broken Link

http://www.cert.org/advisories/CA-2001-21.html

Source: cve@mitre.org

PatchThird Party AdvisoryUS Government Resource

http://www.ciac.org/ciac/bulletins/l-131.shtml

Source: cve@mitre.org

Broken Link

http://www.cisco.com/warp/public/707/catos-telrcv-vuln-pub.shtml

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2001/dsa-070

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2001/dsa-075

Source: cve@mitre.org

Third Party Advisory

http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-068.php3

Source: cve@mitre.org

Broken Link

http://www.novell.com/linux/security/advisories/2001_029_nkitb_txt.html

Source: cve@mitre.org

Broken Link

http://www.osvdb.org/809

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2001-099.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2001-100.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/197804

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB EntryVendor Advisory

http://www.securityfocus.com/bid/3064

Source: cve@mitre.org

ExploitPatchThird Party AdvisoryVDB EntryVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/6875

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:49.telnetd.asc (unsafe URL)