contiki-os/contiki

Incorrectly executing commands of telnet servers

Opened this issue · 0 comments

Telnet servers can execute many commands from clients like ls, help, write and append. For example, the ls command is able to show the contents of a certain directory in remote servers, and then servers reply executing results to clients.

However, telnet servers don't correctly handle all commands. This bug could be reproduced in the case of listing(i.e., ls) the content of a directory with many files. This bug appears as telnet servers put all responses in a fixed-length buffer in the implementation. Telnet servers only put messages into buffer but don't have a check whether successfully or not. Hence, when the buffer is full, it can lead to responses lost.

Remote attackers can write many long-name files in one directory until the buffer is full. Then when receiving requests from clients, servers cannot send any responses to clients. This bug may bring the denial of service to telnet servers.