CVE-1999-0192
published 1997-10-18CVE-1999-0192: Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable.
PriorityP266critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
10.04%
95.1th percentile
Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh
bytes↗
\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04\x03\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xd9\xff\xff\xff/bin/sh
- →Detect exploit-crafted malicious termcap files written to /tmp with the 'xterm|' header prefix followed by a large NOP sled, indicative of the buffer overflow payload. ↗
- →Alert on processes setting the TERMCAP environment variable to a path under /tmp before executing setuid binaries such as xterm. ↗
- →Monitor for creation of world-writable files in /tmp named 'lstermcap' or 'egg_termcap', which are the exploit-stage termcap payload files. ↗
- →Detect execution of /usr/X11R6/bin/xterm with a TERMCAP environment variable pointing to a /tmp path, as both exploit variants use this execution pattern. ↗
- →Scan for the Linux x86 shellcode byte sequence eb1f5e897608 (exploit 1) or eb225e89f389f7 (exploit 2) in /tmp files or process memory, indicating active exploitation of the tgetent() buffer overflow. ↗
- →The exploit uses a default buffer size of 4210 bytes (exploit 2) or 5000 bytes (exploit 1) with a NOP sled; anomalously large TERMCAP environment variable values should be flagged. ↗
- ·The vulnerability only affects systems using libtermcap 2.0.8 and earlier; systems using ncurses (e.g., Debian, Caldera OpenLinux) are not vulnerable. ↗
- ·Under Red Hat Linux 6.0, xterm is not setuid root, limiting the privilege escalation impact compared to Red Hat 5.2 and 4.2. ↗
- ·The quick mitigation recommended is to remove the setuid bit from all suid root programs linked with libtermcap, not just xterm. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cvh8-jv99-rgjm: Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable
ghsa_unreviewed·2022-04-30
CVE-1999-0192 [HIGH] GHSA-cvh8-jv99-rgjm: Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable
Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable.
VulnCheck
Red Hat linux Out-of-bounds Write
vulncheck·1999·CVSS 10.0
CVE-1999-0192 [CRITICAL] Red Hat linux Out-of-bounds Write
Red Hat linux Out-of-bounds Write
Buffer overflow in telnet daemon tgetent routing allows remote attackers to gain root access via the TERMCAP environmental variable.
Affected: Red Hat linux
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments
No detection rules found.
Exploit-DB
RedHat Linux 6.0 / Slackware Linux 4.0 - Termcap 'tgetent()' Local Buffer Overflow (2)
exploitdb·1999-08-18
CVE-1999-0192 RedHat Linux 6.0 / Slackware Linux 4.0 - Termcap 'tgetent()' Local Buffer Overflow (2)
RedHat Linux 6.0 / Slackware Linux 4.0 - Termcap 'tgetent()' Local Buffer Overflow (2)
---
// source: https://www.securityfocus.com/bid/588/info
A buffer overflow existed in libtermcap's tgetent() function, which could cause the user to execute arbitrary code if they were able to supply their own termcap file. Versions of libtermcap 2.0.8 and earliear are vulnerable.
Under Red Hat Linux 5.2 and 4.2, this could lead to local users gaining root privileges, as xterm (as well as other possibly setuid programs) are linked against libtermcap. Under Red Hat Linux 6.0, xterm is not setuid root.
Debian and Caldera OpenLinux use the ncurses library instead of termcap and thus are not vulnerable.
/* Local exploit for suid root programs linked to libtermcap -buffer size defaults to 4210
* ./smas
Exploit-DB
RedHat Linux 6.0 / Slackware Linux 4.0 - Termcap 'tgetent()' Local Buffer Overflow (1)
exploitdb·1999-08-18
CVE-1999-0192 RedHat Linux 6.0 / Slackware Linux 4.0 - Termcap 'tgetent()' Local Buffer Overflow (1)
RedHat Linux 6.0 / Slackware Linux 4.0 - Termcap 'tgetent()' Local Buffer Overflow (1)
---
// source: https://www.securityfocus.com/bid/588/info
A buffer overflow existed in libtermcap's tgetent() function, which could cause the user to execute arbitrary code if they were able to supply their own termcap file. Versions of libtermcap 2.0.8 and earliear are vulnerable.
Under Red Hat Linux 5.2 and 4.2, this could lead to local users gaining root privileges, as xterm (as well as other possibly setuid programs) are linked against libtermcap. Under Red Hat Linux 6.0, xterm is not setuid root.
Debian and Caldera OpenLinux use the ncurses library instead of termcap and thus are not vulnerable.
/*
*** libtermcap xterm exploit ***
*** by m0f0 1999 ***
*** ***
*** it works for xterm/nxterm ***
No writeups or analysis indexed.
1997-10-18
Published
Exploited in the wild