11 lines
No EOL
924 B
Text
11 lines
No EOL
924 B
Text
source: http://www.securityfocus.com/bid/4196/info
|
|
|
|
xtell is a simple network messaging program. It may be used to transmit terminal messages between users and machines. xtell is available for Linux, BSD and most other Unix based operating systems.
|
|
|
|
An information disclosure vulnerability has been reported in some versions of xtell. When a message is sent to a user, the response generated by xtell states whether that user is currently logged on to the system. An attacker may be able to use this information to aid in additional attacks, or in social engineering attempts.
|
|
|
|
It is possible to send a maliciously formatted message to xtell such that this information is disclosed, yet no message is displayed or logged. This may allow the attack to go undetected.
|
|
|
|
Earlier versions of xtell may share this vulnerability. This has not been confirmed.
|
|
|
|
echo :USER::`perl -e 'print "A" x 2000'`| nc victimhost 4224 |