CVE-1999-0192: Buffer Overflow
Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
telnet daemonfrom your environment.Uninstall the telnet daemon from Red Hat Linux and Slackware Linux systems if it is not required.
- Configuration
Stop and disable the telnet daemon (telnetd) on affected Red Hat Linux and Slackware Linux systems to prevent exploitation of the tgetent buffer overflow via the TERMCAP environment variable.
telnet daemon enabled = false - Compensating control
Block or restrict access to TCP port 23 (telnet) at the network perimeter and internal firewalls; allow access only from trusted management hosts if telnet must remain available.
- Operational
For systems that may have been exposed, assume possible root compromise: perform incident response and forensic analysis, rebuild affected systems from trusted media, and rotate root and other credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0192?
CVE-1999-0192 is considered to have a high severity due to the ability of remote attackers to gain root access.
How do I fix CVE-1999-0192?
To fix CVE-1999-0192, you should upgrade to a patched version of the telnet daemon that addresses the buffer overflow vulnerability.
Which systems are affected by CVE-1999-0192?
CVE-1999-0192 affects various versions of Slackware and Red Hat Linux, including versions 3.2 to 3.9 of Slackware and 4.0 to 6.0 of Red Hat.
What type of vulnerability is CVE-1999-0192?
CVE-1999-0192 is a buffer overflow vulnerability found in the telnet daemon affecting environmental variable handling.
Can CVE-1999-0192 be exploited remotely?
Yes, CVE-1999-0192 can be exploited remotely, allowing attackers to execute arbitrary code on the vulnerable system.