PT-2002-1008 · Debian · Xtell

Published 2002-05-03 · Updated 2016-10-18 · CVE-2002-0332

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xtell versions 1.91.1 and earlier xtell versions 2.x before 2.7

Description The issue concerns multiple vulnerabilities in the xtell package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, buffer overflows in xtell can allow remote attackers to execute arbitrary code via a long DNS hostname determined using reverse DNS lookups, a long AUTH string, or certain data in the xtell request.

Recommendations For versions 1.91.1 and earlier, update to a version later than 1.91.1 to resolve the issue. For versions 2.x before 2.7, update to version 2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the xtell service to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-02180

CVE-2002-0332

Affected Products

Xtell

References · 11

• 🔥 https://exploit-db.com/exploits/21309 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0332 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0333 · Security Note
• https://bdu.fstec.ru/vul/2015-02180 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0332 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0334 · Security Note
• http://debian.org/security/2002/dsa-121 · Vendor Advisory
• http://securityfocus.com/bid/4193 · Note
• http://marc.info/?l=bugtraq&m=101494896516467&w=2 · Note
• http://iss.net/security_center/static/8312.php · Note
• http://debian.org/security/dsa-121 · Note