CVEvulnerability
CVE-2011-4862
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2011-12-25
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-120
Description
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Affected configurations
• gnu inetutils (< 1.9)
• heimdal project heimdal (<= 1.5.1)
• mit krb5-appl (<= 1.0.2)
• freebsd freebsd (>= 7.3 <= 9.0)
• fedoraproject fedora 15
• fedoraproject fedora 16
• debian debian linux 5.0
• debian debian linux 6.0
• debian debian linux 7.0
• opensuse opensuse 11.3
• opensuse opensuse 11.4
• suse linux enterprise desktop 10
• suse linux enterprise desktop 11
• suse linux enterprise server 9
• suse linux enterprise server 10
• suse linux enterprise server 11
• suse linux enterprise software development kit 10
• suse linux enterprise software development kit 11
Related
Weakness · CWE (1)
- CWE-120 Buffer Copy without Checking Size of Input weakness
References
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html Broken Link
- http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592 Patch, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html Third Party Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html Vendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html Vendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html Vendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html Mailing List, Third Party Advisory
- http://osvdb.org/78020 Broken Link
- http://secunia.com/advisories/46239 Third Party Advisory
- http://secunia.com/advisories/47341 Third Party Advisory
- http://secunia.com/advisories/47348 Third Party Advisory
- http://secunia.com/advisories/47357 Third Party Advisory
- http://secunia.com/advisories/47359 Third Party Advisory
- http://secunia.com/advisories/47373 Third Party Advisory
- http://secunia.com/advisories/47374 Third Party Advisory
- http://secunia.com/advisories/47397 Third Party Advisory
- http://secunia.com/advisories/47399 Third Party Advisory
- http://secunia.com/advisories/47441 Third Party Advisory
- http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc Mitigation, Vendor Advisory
- http://security.freebsd.org/patches/SA-11:08/telnetd.patch Patch, Vendor Advisory
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt Patch, Vendor Advisory
- http://www.debian.org/security/2011/dsa-2372 Third Party Advisory
- http://www.debian.org/security/2011/dsa-2373 Third Party Advisory
- http://www.debian.org/security/2011/dsa-2375 Third Party Advisory
- http://www.exploit-db.com/exploits/18280/ Exploit, Third Party Advisory, VDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:195 Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1851.html Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1852.html Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1853.html Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1854.html Third Party Advisory
- http://www.securitytracker.com/id?1026460 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1026463 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/71970 Third Party Advisory, VDB Entry
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html Broken Link
- http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592 Patch, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html Third Party Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html Vendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html Vendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html Vendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html Mailing List, Third Party Advisory
- http://osvdb.org/78020 Broken Link
- http://secunia.com/advisories/46239 Third Party Advisory
- http://secunia.com/advisories/47341 Third Party Advisory
- http://secunia.com/advisories/47348 Third Party Advisory
- http://secunia.com/advisories/47357 Third Party Advisory
- http://secunia.com/advisories/47359 Third Party Advisory
- http://secunia.com/advisories/47373 Third Party Advisory
- http://secunia.com/advisories/47374 Third Party Advisory
- http://secunia.com/advisories/47397 Third Party Advisory
- http://secunia.com/advisories/47399 Third Party Advisory
- http://secunia.com/advisories/47441 Third Party Advisory
- http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc Mitigation, Vendor Advisory
- http://security.freebsd.org/patches/SA-11:08/telnetd.patch Patch, Vendor Advisory
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt Patch, Vendor Advisory
- http://www.debian.org/security/2011/dsa-2372 Third Party Advisory
- http://www.debian.org/security/2011/dsa-2373 Third Party Advisory
- http://www.debian.org/security/2011/dsa-2375 Third Party Advisory
- http://www.exploit-db.com/exploits/18280/ Exploit, Third Party Advisory, VDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:195 Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1851.html Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1852.html Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2011-1853.html Third Party Advisory