Two Microsoft products, the Telnet service in Windows 2000, and the Telnet daemon (telnetd) in Interix 2.2, have an unchecked buffer in their code, thereby providing a buffer-overflow vulnerability that could allow a hacker to ‘own’ those servers.
By sending a malformed request to such a server, an attacker could cause it to fail, and / or leave it in a state where the attacker could run code of their own choice, including Distributed Denial of Service (DDoS) attacks.
A compromised system would allow code to be run in the same context as the Telnet services. In the case of Windows 2000, the code would execute within the SYSTEM context, thus would allowing the attacker to execute commands with the same privileges as the operating system. This means the code could take any action, including reformatting the hard drive, spawning a remote command shell with SYSTEM privileges, installing programs, or shutting down the system.
Even so, the severity of this vulnerability is only moderate, assuming that firewalls are in place. While Telnet services are installed by default, they do not run by default, and have to be invoked.
Microsoft has issued patches which will check the buffer in question. They are available at www.microsoft.com/windows2000/downloads/security/q307298/default.asp for Windows 2000 and www.microsoft.com/downloads/release.asp?ReleaseID=35969 for Interix. In addition, the fix for Win2K is included within Windows 2000 Security Roll-up Package 1.
