[Security] telnetd slcbuf global buffer overflo w in add_slc() — pre-auth, remotely triggerable
zhangph <[email protected]> Thu, 11 Jun 2026 15:50:22 +0800 (CST)
| Newsgroups | gmane.comp.gnu.inetutils.bugs |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_101211_883512953.1781164222535 Content-Type: text/plain; charset=GBK Content-Transfer-Encoding: base64 VG86IGJ1Zy1pbmV0dXRpbHNAZ251Lm9yZwpTdWJqZWN0OiBbU2VjdXJpdHldIHRlbG5ldGQgc2xj YnVmIGdsb2JhbCBidWZmZXIgb3ZlcmZsb3cgaW4gYWRkX3NsYygpIKGqIHByZS1hdXRoLCByZW1v dGVseSB0cmlnZ2VyYWJsZQoKCkhpLAoKClJhbiBpbnRvIGEgYnVmZmVyIG92ZXJmbG93IGluIHRl bG5ldGQncyBTTEMgaGFuZGxpbmcgd2hpbGUgZnV6emluZyBpbmV0dXRpbHMgMi4yLgpUaGUgYWRk X3NsYygpIGZ1bmN0aW9uIGluIHRlbG5ldGQvc2xjLmMgd3JpdGVzIHRyaXBsZXRzIGludG8gYSBm aXhlZC1zaXplIGdsb2JhbApidWZmZXIgd2l0aG91dCBhbnkgYm91bmRzIGNoZWNrLCBzbyBhIGNs aWVudCBjYW4gb3ZlcmZsb3cgaXQgYnkgc2VuZGluZyB0b28gbWFueQpTTEMgZW50cmllcyBpbiBh IHNpbmdsZSBMSU5FTU9ERSBzdWJvcHRpb24uCgoKVGhlIHZ1bG5lcmFibGUgY29kZSAoc2xjLmM6 MTY2LTE3OCk6CgoKICAgIHN0YXRpYyB1bnNpZ25lZCBjaGFyIHNsY2J1ZltOU0xDICogNl07IC8q IDEwOCBieXRlcyAqLwogICAgc3RhdGljIHVuc2lnbmVkIGNoYXIgKnNsY3B0cjsKCgogICAgdm9p ZCBhZGRfc2xjKHJlZ2lzdGVyIGNoYXIgZnVuYywgcmVnaXN0ZXIgY2hhciBmbGFnLCByZWdpc3Rl ciBjY190IHZhbCkKICAgIHsKICAgICAgaWYgKCgqc2xjcHRyKysgPSAodW5zaWduZWQgY2hhcikg ZnVuYykgPT0gMHhmZikKICAgICAgICAqc2xjcHRyKys7CiAgICAgIGlmICgoKnNsY3B0cisrID0g KHVuc2lnbmVkIGNoYXIpIGZsYWcpID09IDB4ZmYpCiAgICAgICAgKnNsY3B0cisrOwogICAgICBp ZiAoKCpzbGNwdHIrKyA9ICh1bnNpZ25lZCBjaGFyKSB2YWwpID09IDB4ZmYpCiAgICAgICAgKnNs Y3B0cisrOwogICAgfQoKCnN0YXJ0X3NsYygpIHNldHMgc2xjcHRyID0gc2xjYnVmICsgNCAoNC1i eXRlIGhlYWRlcikuIEVhY2ggdHJpcGxldCBhZGRzIDMgYnl0ZXMuCk5vIGxlbmd0aCBjaGVjayBh bnl3aGVyZS4gT25jZSBkb19vcHRfc2xjKCkgcHJvY2Vzc2VzIG1vcmUgdGhhbiAzNCB0cmlwbGV0 cyBmcm9tCmEgc2luZ2xlIHN1Ym9wdGlvbiwgc2xjcHRyIGdvZXMgcGFzdCB0aGUgZW5kIG9mIHNs Y2J1Zi4KCgpUbyB0cmlnZ2VyLCBhIGNsaWVudCBzZW5kczoKCgogICAgRkYgRkIgMjIgIyBJQUMg V0lMTCBMSU5FTU9ERQogICAgRkYgRkEgMjIgMDMgKDEzIDAzIDAxIKHBIDM1KSBGRiBGMCAjIElB QyBTQiBMSU5FTU9ERSBTTEMgKyAzNSB0cmlwbGV0cyArIFNFCgoKV2l0aCBBU0FOOgoKCiAgICBn bG9iYWwtYnVmZmVyLW92ZXJmbG93IG9uIGFkZHJlc3MgMHgwMDAwMDBkZDgyMmMKICAgIFdSSVRF IG9mIHNpemUgMSBhdCAweDAwMDAwMGRkODIyYwogICAgICAgICMwIGFkZF9zbGMgc2xjLmM6MTc1 CiAgICAgICAgIzEgcHJvY2Vzc19zbGMgc2xjLmM6MjY4CiAgICAgICAgIzIgZG9fb3B0X3NsYyBz bGMuYzo0OTgKICAgICAgICAjMyBzdWJvcHRpb24gc3RhdGUuYzoxMjYzCiAgICAweDAwMDAwMGRk ODIyYyBpcyBsb2NhdGVkIDAgYnl0ZXMgdG8gdGhlIHJpZ2h0IG9mICdzbGNidWYnIChzaXplIDEw OCkKCgpCb3VuZGFyeSBpcyBzaGFycDogMzQgdHJpcGxldHMgPSAxMDYgYnl0ZXMsIG5vIGNyYXNo LiAzNiB0cmlwbGV0cyA9IDExMiBieXRlcywKY3Jhc2guIE1heCBvdmVyZmxvdyBpcyB+NDAwIGJ5 dGVzIChsaW1pdGVkIGJ5IHN1YmJ1ZmZlcls1MTJdKS4KCgpUaGlzIGhhcHBlbnMgZHVyaW5nIG9w dGlvbiBuZWdvdGlhdGlvbiwgYmVmb3JlIGFueSBhdXRoZW50aWNhdGlvbi4KCgpUaGUgYWRqYWNl bnQgZ2xvYmFsIGlzIGRlZl9zbGNidWYgKGEgcG9pbnRlciksIHNvIGlmIHRoZSBvdmVyZmxvdyBy ZWFjaGVzIGl0LApkZWZlcnNsYygpIHdvdWxkIGxhdGVyIHVzZSBhIGNvcnJ1cHRlZCBwb2ludGVy IGluIGEgbWVtbW92ZS4gV2hldGhlciB0aGF0J3MKcHJhY3RpY2FsbHkgZXhwbG9pdGFibGUgZGVw ZW5kcyBvbiBsaW5rZXIgbGF5b3V0IKGqIGluIG15IGJ1aWxkIHRoZXJlJ3MgYSA1Mi1ieXRlCmdh cCAoQVNBTiByZWR6b25lKSwgYnV0IHByb2R1Y3Rpb24gYnVpbGRzIG1heSBwbGFjZSB0aGluZ3Mg ZGlmZmVyZW50bHkuCgoKU3VnZ2VzdGVkIGZpeCChqiBhZGQgYSBib3VuZHMgY2hlY2sgaW4gYWRk X3NsYygpOgoKCiAgICB2b2lkIGFkZF9zbGMocmVnaXN0ZXIgY2hhciBmdW5jLCByZWdpc3RlciBj aGFyIGZsYWcsIHJlZ2lzdGVyIGNjX3QgdmFsKQogICAgewogICAgICBpZiAoc2xjcHRyICsgNiA+ IHNsY2J1ZiArIHNpemVvZihzbGNidWYpKQogICAgICAgIHJldHVybjsKICAgICAgLyogLi4uIGV4 aXN0aW5nIGNvZGUgLi4uICovCiAgICB9CgoKQW5kIGEgc2ltaWxhciBjaGVjayBiZWZvcmUgdGhl IHNwcmludGYgaW4gZW5kX3NsYygpIGF0IGxpbmUgMjQwLgoKCkhhcHB5IHRvIHNlbmQgb3ZlciB0 aGUgZnVsbCBQb0MsIEFTQU4gbG9ncywgYW5kIGFuYWx5c2lzIGlmIHVzZWZ1bC4gVGhpcyBjb2Rl CmdvZXMgYmFjayB0byA0LjRCU0Qgc28gb3RoZXIgdGVsbmV0ZCBpbXBsZW1lbnRhdGlvbnMgbWF5 IGhhdmUgdGhlIHNhbWUgaXNzdWUuCgoKVGhhbmtzCgo= ------=_Part_101211_883512953.1781164222535 Content-Type: text/html; charset=GBK Content-Transfer-Encoding: base64 PGRpdiBkYXRhLW50ZXM9Im50ZXNfbWFpbF9ib2R5X3Jvb3QiIHN0eWxlPSJsaW5lLWhlaWdodDox Ljc7Y29sb3I6IzAwMDAwMDtmb250LXNpemU6MTRweDtmb250LWZhbWlseTpBcmlhbCI+PGRpdiBz dHlsZT0ibWFyZ2luOjA7Ij5UbzogYnVnLWluZXR1dGlsc0BnbnUub3JnPC9kaXY+PGRpdiBzdHls ZT0ibWFyZ2luOjA7Ij5TdWJqZWN0OiBbU2VjdXJpdHldIHRlbG5ldGQgc2xjYnVmIGdsb2JhbCBi dWZmZXIgb3ZlcmZsb3cgaW4gYWRkX3NsYygpIKGqIHByZS1hdXRoLCByZW1vdGVseSB0cmlnZ2Vy YWJsZTwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+PGJyPjwvZGl2PjxkaXYgc3R5bGU9Im1h cmdpbjowOyI+SGksPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij48YnI+PC9kaXY+PGRpdiBz dHlsZT0ibWFyZ2luOjA7Ij5SYW4gaW50byBhIGJ1ZmZlciBvdmVyZmxvdyBpbiB0ZWxuZXRkJ3Mg U0xDIGhhbmRsaW5nIHdoaWxlIGZ1enppbmcgaW5ldHV0aWxzIDIuMi48L2Rpdj48ZGl2IHN0eWxl PSJtYXJnaW46MDsiPlRoZSBhZGRfc2xjKCkgZnVuY3Rpb24gaW4gdGVsbmV0ZC9zbGMuYyB3cml0 ZXMgdHJpcGxldHMgaW50byBhIGZpeGVkLXNpemUgZ2xvYmFsPC9kaXY+PGRpdiBzdHlsZT0ibWFy Z2luOjA7Ij5idWZmZXIgd2l0aG91dCBhbnkgYm91bmRzIGNoZWNrLCBzbyBhIGNsaWVudCBjYW4g b3ZlcmZsb3cgaXQgYnkgc2VuZGluZyB0b28gbWFueTwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjow OyI+U0xDIGVudHJpZXMgaW4gYSBzaW5nbGUgTElORU1PREUgc3Vib3B0aW9uLjwvZGl2PjxkaXYg c3R5bGU9Im1hcmdpbjowOyI+PGJyPjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+VGhlIHZ1 bG5lcmFibGUgY29kZSAoc2xjLmM6MTY2LTE3OCk6PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7 Ij48YnI+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5ic3A7IHN0YXRpYyB1 bnNpZ25lZCBjaGFyIHNsY2J1ZltOU0xDICogNl07ICAvKiAxMDggYnl0ZXMgKi88L2Rpdj48ZGl2 IHN0eWxlPSJtYXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgc3RhdGljIHVuc2lnbmVkIGNoYXIgKnNs Y3B0cjs8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJt YXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgdm9pZCBhZGRfc2xjKHJlZ2lzdGVyIGNoYXIgZnVuYywg cmVnaXN0ZXIgY2hhciBmbGFnLCByZWdpc3RlciBjY190IHZhbCk8L2Rpdj48ZGl2IHN0eWxlPSJt YXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgezwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsgaWYgKCgqc2xjcHRyKysgPSAodW5zaWduZWQgY2hhcikgZnVuYykg PT0gMHhmZik8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAqc2xjcHRyKys7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5i c3A7ICZuYnNwOyBpZiAoKCpzbGNwdHIrKyA9ICh1bnNpZ25lZCBjaGFyKSBmbGFnKSA9PSAweGZm KTwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICpzbGNwdHIrKzs8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgJm5i c3A7IGlmICgoKnNsY3B0cisrID0gKHVuc2lnbmVkIGNoYXIpIHZhbCkgPT0gMHhmZik8L2Rpdj48 ZGl2IHN0eWxlPSJtYXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAqc2xjcHRy Kys7PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5ic3A7IH08L2Rpdj48ZGl2 IHN0eWxlPSJtYXJnaW46MDsiPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPnN0YXJ0 X3NsYygpIHNldHMgc2xjcHRyID0gc2xjYnVmICsgNCAoNC1ieXRlIGhlYWRlcikuIEVhY2ggdHJp cGxldCBhZGRzIDMgYnl0ZXMuPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij5ObyBsZW5ndGgg Y2hlY2sgYW55d2hlcmUuIE9uY2UgZG9fb3B0X3NsYygpIHByb2Nlc3NlcyBtb3JlIHRoYW4gMzQg dHJpcGxldHMgZnJvbTwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+YSBzaW5nbGUgc3Vib3B0 aW9uLCBzbGNwdHIgZ29lcyBwYXN0IHRoZSBlbmQgb2Ygc2xjYnVmLjwvZGl2PjxkaXYgc3R5bGU9 Im1hcmdpbjowOyI+PGJyPjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+VG8gdHJpZ2dlciwg YSBjbGllbnQgc2VuZHM6PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij48YnI+PC9kaXY+PGRp diBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5ic3A7IEZGIEZCIDIyICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIyBJQUMgV0lMTCBMSU5FTU9ERTwvZGl2PjxkaXYgc3R5bGU9 Im1hcmdpbjowOyI+Jm5ic3A7ICZuYnNwOyBGRiBGQSAyMiAwMyAoMTMgMDMgMDEgocEgMzUpIEZG IEYwICAgICAgICAgICMgSUFDIFNCIExJTkVNT0RFIFNMQyArIDM1IHRyaXBsZXRzICsgU0U8L2Rp dj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsi PldpdGggQVNBTjo8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPjxicj48L2Rpdj48ZGl2IHN0 eWxlPSJtYXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgZ2xvYmFsLWJ1ZmZlci1vdmVyZmxvdyBvbiBh ZGRyZXNzIDB4MDAwMDAwZGQ4MjJjPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsg Jm5ic3A7IFdSSVRFIG9mIHNpemUgMSBhdCAweDAwMDAwMGRkODIyYzwvZGl2PjxkaXYgc3R5bGU9 Im1hcmdpbjowOyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICMwIGFkZF9zbGMgc2xjLmM6 MTc1PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgIzEgcHJvY2Vzc19zbGMgc2xjLmM6MjY4PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4m bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgIzIgZG9fb3B0X3NsYyBzbGMuYzo0OTg8L2Rpdj48 ZGl2IHN0eWxlPSJtYXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAjMyBzdWJv cHRpb24gc3RhdGUuYzoxMjYzPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5i c3A7IDB4MDAwMDAwZGQ4MjJjIGlzIGxvY2F0ZWQgMCBieXRlcyB0byB0aGUgcmlnaHQgb2YgJ3Ns Y2J1ZicgKHNpemUgMTA4KTwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+PGJyPjwvZGl2Pjxk aXYgc3R5bGU9Im1hcmdpbjowOyI+Qm91bmRhcnkgaXMgc2hhcnA6IDM0IHRyaXBsZXRzID0gMTA2 IGJ5dGVzLCBubyBjcmFzaC4gMzYgdHJpcGxldHMgPSAxMTIgYnl0ZXMsPC9kaXY+PGRpdiBzdHls ZT0ibWFyZ2luOjA7Ij5jcmFzaC4gTWF4IG92ZXJmbG93IGlzIH40MDAgYnl0ZXMgKGxpbWl0ZWQg Ynkgc3ViYnVmZmVyWzUxMl0pLjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+PGJyPjwvZGl2 PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+VGhpcyBoYXBwZW5zIGR1cmluZyBvcHRpb24gbmVnb3Rp YXRpb24sIGJlZm9yZSBhbnkgYXV0aGVudGljYXRpb24uPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2lu OjA7Ij48YnI+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij5UaGUgYWRqYWNlbnQgZ2xvYmFs IGlzIGRlZl9zbGNidWYgKGEgcG9pbnRlciksIHNvIGlmIHRoZSBvdmVyZmxvdyByZWFjaGVzIGl0 LDwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+ZGVmZXJzbGMoKSB3b3VsZCBsYXRlciB1c2Ug YSBjb3JydXB0ZWQgcG9pbnRlciBpbiBhIG1lbW1vdmUuIFdoZXRoZXIgdGhhdCdzPC9kaXY+PGRp diBzdHlsZT0ibWFyZ2luOjA7Ij5wcmFjdGljYWxseSBleHBsb2l0YWJsZSBkZXBlbmRzIG9uIGxp bmtlciBsYXlvdXQgoaogaW4gbXkgYnVpbGQgdGhlcmUncyBhIDUyLWJ5dGU8L2Rpdj48ZGl2IHN0 eWxlPSJtYXJnaW46MDsiPmdhcCAoQVNBTiByZWR6b25lKSwgYnV0IHByb2R1Y3Rpb24gYnVpbGRz IG1heSBwbGFjZSB0aGluZ3MgZGlmZmVyZW50bHkuPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7 Ij48YnI+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij5TdWdnZXN0ZWQgZml4IKGqIGFkZCBh IGJvdW5kcyBjaGVjayBpbiBhZGRfc2xjKCk6PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij48 YnI+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5ic3A7IHZvaWQgYWRkX3Ns YyhyZWdpc3RlciBjaGFyIGZ1bmMsIHJlZ2lzdGVyIGNoYXIgZmxhZywgcmVnaXN0ZXIgY2NfdCB2 YWwpPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5ic3A7IHs8L2Rpdj48ZGl2 IHN0eWxlPSJtYXJnaW46MDsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7IGlmIChzbGNwdHIgKyA2ICZn dDsgc2xjYnVmICsgc2l6ZW9mKHNsY2J1ZikpPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4m bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgcmV0dXJuOzwvZGl2PjxkaXYgc3R5bGU9Im1hcmdp bjowOyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgLyogLi4uIGV4aXN0aW5nIGNvZGUgLi4uICovPC9k aXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij4mbmJzcDsgJm5ic3A7IH08L2Rpdj48ZGl2IHN0eWxl PSJtYXJnaW46MDsiPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPkFuZCBhIHNpbWls YXIgY2hlY2sgYmVmb3JlIHRoZSBzcHJpbnRmIGluIGVuZF9zbGMoKSBhdCBsaW5lIDI0MC48L2Rp dj48ZGl2IHN0eWxlPSJtYXJnaW46MDsiPjxicj48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46MDsi PkhhcHB5IHRvIHNlbmQgb3ZlciB0aGUgZnVsbCBQb0MsIEFTQU4gbG9ncywgYW5kIGFuYWx5c2lz IGlmIHVzZWZ1bC4gVGhpcyBjb2RlPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij5nb2VzIGJh Y2sgdG8gNC40QlNEIHNvIG90aGVyIHRlbG5ldGQgaW1wbGVtZW50YXRpb25zIG1heSBoYXZlIHRo ZSBzYW1lIGlzc3VlLjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjowOyI+PGJyPjwvZGl2PjxkaXYg c3R5bGU9Im1hcmdpbjowOyI+VGhhbmtzPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOjA7Ij48YnI+ PC9kaXY+PC9kaXY+ ------=_Part_101211_883512953.1781164222535--