NetSight
IP …
critical10.0Public exploit code

CVE-2011-4862

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

Affected products

VendorProductAffected versions
GnuInetutils
before 1.9
Heimdal ProjectHeimdal
through 1.5.1
MitKrb5-Appl
through 1.0.2
FreebsdFreebsd
from 7.3 through 9.0
FedoraprojectFedora
Versions 15, 16
DebianDebian Linux
Versions 5.0, 6.0, 7.0
OpensuseOpensuse
Versions 11.3, 11.4
SuseLinux Enterprise Desktop
Versions 10, 11
SuseLinux Enterprise Server
Versions 9, 10, 11
SuseLinux Enterprise Software Development Kit
Versions 10, 11

Weakness classification

CWE-120

References