Multiple Vendor Telnet Client Information Disclosure Vulnerability iDEFENSE Security Advisory 06.14.05 www.idefense.com/application/poi/display?id=260&type=vulnerabilities June 14, 2005 I. BACKGROUND The TELNET protocol allows virtual network terminals to be connected to over the internet. The initial description of the telnet protocol was given in RFC854 in May 1983. Since then there have been many extra features added including encryption. II. DESCRIPTION Remote exploitation of an input validation error in multiple telnet clients could allow an attacker to gain sensitive information about the victim's system. The vulnerability specifically exists in the handling of the NEW-ENVIRON command. In order to exploit this vulnerability, a malicious server can send a connected client the following telnet command: SB NEW-ENVIRON SEND ENV_USERVAR SE Vulnerable telnet clients will send the contents of the reference environment variable, which may contain information useful to an attacker. The expected behavior would be only to send environment variables related directly to the operation of the telnet client (for example, TERM), or those specifically allowed by the user. III. ANALYSIS Successful exploitation of the vulnerability would allow an attacker to read the values of arbitrary environment variables. By itself this vulnerability is not a large threat, but exploiting this vulnerability may give an attacker more information about a targeted system, which could allow more effective attacks. In order to exploit this vulnerability, an attacker would need to convince the user to connect to their malicious server. It may be possible to automatically launch the telnet command from a web page, for example