Critical Buffer Overflow Vulnerability in inetutils and netkit-telnet-ssl Packages
Summary
UBUNTU-CVE-2020-10188: utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions. Affects inetutils versions < 2:1.9.2-1ubuntu0.1~esm2. Fixed in 2:1.9.2-1ubuntu0.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The inetutils package provides a collection of common network utilities, including FTP, telnet, and ping, essential for network communication and management. The netkit-telnet-ssl package offers secure telnet services. Both packages are widely used in Ubuntu environments, making them critical components for system administrators and users. The vulnerability in question allows remote attackers to exploit a buffer overflow, potentially leading to arbitrary code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10188, originates from a flaw in the utility.c file of the telnetd service within the netkit telnet package. This flaw allows remote attackers to execute arbitrary code through short writes or urgent data, primarily due to a buffer overflow involving the netclear and nextitem functions. The ramifications of this vulnerability are severe, as it can lead to unauthorized access and control over affected systems, compromising their integrity and confidentiality.
How To Fix
Minimum fixed version
2:1.9.2-1ubuntu0.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade inetutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the telnet service or restrict access to it until the package is updated. This can be done by running the following command:
sudo systemctl stop telnetd
sudo systemctl disable telnetd
Conclusion
The CVE-2020-10188 vulnerability poses a significant risk to systems using the inetutils and netkit-telnet-ssl packages. Users are strongly advised to update their packages to the patched versions and consider implementing workarounds until the updates are applied. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for inetutils →
FAQ
CVE-2020-10188 is a critical buffer overflow vulnerability in the inetutils and netkit-telnet-ssl packages that allows remote attackers to execute arbitrary code.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2020-10188 is 9.8, indicating a critical level of severity.
Exploitation of this vulnerability can lead to unauthorized access, control over affected systems, and potential data breaches.
Yes, patched versions of the inetutils and netkit-telnet-ssl packages are available. Users should update to the latest versions to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for inetutils.
