Daniel Lubel

The software follows LDAP referrals from the configured LDAP server. An attacker who controls the LDAP server or performs a machine-in-the-middle attack can forward these referrals to an RMI URL. This causes the Jenkins controller to deserialize attacker-controlled data, which can lead to Remote Code Execution (RCE) if deserialization gadgets are present on the classpath. Deserialization gadgets are specific classes available in the application's environment that can be abused during the process of converting data back into an object to execute unintended code.

The plugin deserializes data from LDAP referrals without proper validation. Deserialization is the process of converting a data stream back into an object, which, when performed on untrusted data without validation, can lead to security compromises.

A buffer overflow exists in the LINEMODE SLC (Set Local Characters) suboption handler of the telnetd daemon. The issue occurs because the `add slc()` function does not verify if the buffer is full before copying data, leading to an out-of-bounds write. An unauthenticated remote attacker can exploit this by sending a specially crafted packet during the initial connection handshake via port 23, potentially achieving remote code execution with root privileges. Approximately 50,000 internet-exposed assets have been identified as potentially affected.