Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers. This issue only affects the telnet client — accessible from the CLI or shell — in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1 versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7781-1 advisory.

    Matthew Hickey discovered that Inetutils did not correctly handle certain escape characters. An attacker     could possibly use this issue to cause a denial of service. (CVE-2019-0053)

    It was discovered that Inetutils did not correctly handle certain memory operations. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2020-10188)

    It was discovered that Inetutils did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause a denial of service. (CVE-2022-39028)

    It was discovered that Inetutils did not check the return values of set*id functions. An attacker could     possibly use this issue to escalate their privileges. (CVE-2023-40303)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to     stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-     based overflow is present in the handling of environment variables when connecting via the telnet client     to remote telnet servers. This issue only affects the telnet client  accessible from the CLI or shell     in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks     Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions     prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior     to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1     versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3;
    17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions     prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to     18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3,     18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. (CVE-2019-0053)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3611 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3611-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     October 08, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : inetutils     Version        : 2:1.9.4-7+deb10u3     CVE ID         : CVE-2019-0053 CVE-2023-40303     Debian Bug     : 945861 1049365

    Security issues were discovered in inetutils, a collection of GNU     network utilities, which could lead to privilege escalation or     potentially execution of arbitrary code.

    CVE-2019-0053

        Thorsten Alteholz discovered that CVE-2019-0053 was patched         incorrectly in inetutils 2:1.9.4-7+deb10u3.  The original         vulnerability remained: inetutils' telnet client doesn't         sufficiently validate environment variables, which can lead to         stack-based buffer overflows.  (This issue is limited to local         exploitation from restricted shells.)

    CVE-2023-40303

        Jeffrey Bencteux discovered that several setuid(), setgid(),         seteuid() and setguid() return values were not checked in ftpd/         rcp/rlogin/rsh/rshd/uucpd code, which may lead to privilege         escalation.

    For Debian 10 buster, these problems have been fixed in version     2:1.9.4-7+deb10u3.

    We recommend that you upgrade your inetutils packages.

    For the detailed security status of inetutils please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/inetutils

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3205 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3205-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     November 25, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : inetutils     Version        : 2:1.9.4-7+deb10u2     CVE ID         : CVE-2019-0053 CVE-2021-40491 CVE-2022-39028     Debian Bug     : 945861 956084 993476

    Several security vulnerabilities were discovered in inetutils, a     collection of common network programs.

    CVE-2019-0053

        inetutils' telnet client doesn't sufficiently validate environment         variables, which can lead to stack-based buffer overflows.  This         issue is limited to local exploitation from restricted shells.

    CVE-2021-40491

        inetutils' ftp client before 2.2 does not validate addresses         returned by PSV/LSPV responses to make sure they match the server         address.  A malicious server can exploit this flaw to reach services         in the client's private network.  (This is similar to curl's         CVE-2020-8284.)

    CVE-2022-39028

        inetutils's telnet server through 2.3 has a NULL pointer dereference         which a client can trigger by sending 0xff 0xf7 or 0xff 0xf8.  In a         typical installation, the telnetd application would crash but the         telnet service would remain available through inetd.  However, if the         telnetd application has many crashes within a short time interval,         the telnet service would become unavailable after inetd logs a         telnet/tcp server failing (looping), service terminated error.

    For Debian 10 buster, these problems have been fixed in version     2:1.9.4-7+deb10u2.

    We recommend that you upgrade your inetutils packages.

    For the detailed security status of inetutils please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/inetutils

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Junos OS installed on the remote host is prior to 12.3R12-S13, 12.3X48-D80, 14.1X53-D130, 15.1F6-S12, 15.1X49-D170, 15.1X53-D237, 16.1R3-S11, 16.2R2-S9, 17.1R3, 17.2R1-S8, 17.3R3-S4, 17.4R1-S6, 18.1R2-S4, 18.2R1-S5, 18.2X75-D40, 18.3R1-S3, or 18.4R1-S2. It is, therefore, affected by a vulnerability as referenced in the JSA10947 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Insufficient validation of environment variables in the telnet client supplied in FreeBSD can lead to stack-based buffer overflows. A stack- based overflow is present in the handling of environment variables when connecting via the telnet client to remote telnet servers.

This issue only affects the telnet client. Inbound telnet sessions to telnetd(8) are not affected by this issue. Impact : These buffer overflows may be triggered when connecting to a malicious server, or by an active attacker in the network path between the client and server. Specially crafted TELNET command sequences may cause the execution of arbitrary code with the privileges of the user invoking telnet(1).

ID	Name	Product	Family	Severity
266306	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Inetutils vulnerabilities (USN-7781-1)	Nessus	Ubuntu Local Security Checks	critical
256729	Linux Distros Unpatched Vulnerability : CVE-2019-0053	Nessus	Misc.	high
182761	Debian dla-3611 : inetutils-ftp - security update	Nessus	Debian Local Security Checks	high
168204	Debian dla-3205 : inetutils-ftp - security update	Nessus	Debian Local Security Checks	high
130517	Juniper JSA10947	Nessus	Junos Local Security Checks	high
127542	FreeBSD : FreeBSD -- telnet(1) client multiple vulnerabilities (39f6cbff-b30a-11e9-a87f-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2019-0053

high

Tenable Plugins

critical

high

high

high

high

high