Once this file has been transferred to the remote system, the attacker must only be able to connect to the telnet daemon, to obtain super-user access. Many programs pass in a buffer of size 1024 bytes. By creating a termcap terminal specification larger than 1024 bytes, we can overflow a buffer in the calling function. If this buffer is stored on the stack in the calling function, we can cause arbitrary machine code to be executed.
Remote individuals can obtain super-user access to any vulnerable system.
The current versions of Linux which were tested include Slackware and Redhat, which appear to be NOT vulnerable. IRIX IRIX appears to be NOT vulnerable. Current versions of NetBSD are not vulnerable. Versions of FreeBSD newer than 2.1.5 are NOT vulnerable to this problem. FreeBSD 2.2.2 are NOT vulnerable.