CVE-2005-1205

An attacker hosts a malicious Telnet server or crafts a Telnet URL that causes the victim's Telnet client to connect to it. Once connected, the attacker sends a NEW-ENVIRON SEND ENV_USERVAR command, and the vulnerable Telnet client responds by transmitting the user's session environment variables [ref_id=1]. The attacker can deliver the malicious Telnet URL via a web page (persuading the user to click a link) or via an email message containing the crafted URL [ref_id=1]. User interaction (clicking the link or connecting to the malicious server) is required in every case [ref_id=1].

The advisory does not specify individual function names or file paths. The vulnerability exists in the Telnet client component of Microsoft Windows XP, Windows Server 2003, and Windows Services for UNIX (all versions) [ref_id=1].

The update restricts which session variables the Telnet client will disclose to a Telnet server. It limits responses to only the "well known" variables defined in Internet RFC 1572, plus the SFUTLNTVER and SFUTLNTMODE variables needed by Windows Services for UNIX Telnet servers; all other session variables are blocked [ref_id=1]. A new registry key was also added to let administrators specify additional environment variables that the Telnet client may disclose [ref_id=1].