Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Dec 2018 13:10:51 -0800
From: Alan Coopersmith <>
        Hacker Fantastic <>
Subject: Re: Multiple telnet.c overflows

On 12/11/18 10:39 AM, Hacker Fantastic wrote:
> When a telnet server requests environment options the sprintf on line 1002 will
> not perform bounds checking and causes an overflow of stack buffer
> temp[50] defined
> at line 990. This issue can be trivially fixed using a patch to add
> bounds checking
> to sprintf such as with a call to snprintf();

GNU inetutils telnet is a fork of the original BSD telnet code, but most of
the BSD's seem to have already switched to snprintf a while ago:

with NetBSD as the outlier:

illumos also uses snprintf, in the code it inherited from OpenSolaris:


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.