PT-2005-2221 · Microsoft · Windows Server 2003+3

Gaël Delalleau · Published 2005-06-14 · Updated 2018-10-12 · CVE-2005-1205

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Services for UNIX

Description The issue allows remote attackers to read sensitive environment variables. This is achieved via the NEW-ENVIRON option with a SEND ENV USERVAR command in the Telnet client.

Recommendations For Microsoft Windows XP, consider disabling the Telnet client until a fix is available. For Microsoft Windows Server 2003, restrict access to the Telnet service to minimize the risk of exploitation. For Microsoft Windows Services for UNIX, avoid using the Telnet client with the NEW-ENVIRON option until the issue is resolved.

Fix

Related Identifiers

CVE-2005-1205

Affected Products

Windows Server 2003

Windows Services For Unix

Windows Xp

Telnet

References · 10

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-033 · Vendor Advisory
• http://idefense.com/application/poi/display?id=260&type=vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1205 · Security Note
• http://kb.cert.org/vuls/id/800829 · Patch
• http://secunia.com/advisories/15690 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1132 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A784 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A605 · Note
• http://securityfocus.com/bid/13940 · Note
• http://securitytracker.com/id?1014203 · Note