Vulnerability Description
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Inetutils | < 1.9 |
| Heimdal Project | Heimdal | <= 1.5.1 |
| Mit | Krb5-Appl | <= 1.0.2 |
| Freebsd | Freebsd | >= 7.3, <= 9.0 |
| Fedoraproject | Fedora | 15 |
| Debian | Debian Linux | 5.0 |
| Opensuse | Opensuse | 11.3 |
| Suse | Linux Enterprise Desktop | 10 |
| Suse | Linux Enterprise Server | 9 |
| Suse | Linux Enterprise Software Development Kit | 10 |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.htmlBroken Link
- http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11PatchThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.htThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.htThird Party Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.htmlVendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.htmlVendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.htmlVendor Advisory
- http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.htmlVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2011-4862?
CVE-2011-4862 is a vulnerability with a CVSS score of 10.0 (HIGH). Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possi...
How severe is CVE-2011-4862?
CVE-2011-4862 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-4862?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Inetutils, Heimdal Project Heimdal, Mit Krb5-Appl, Freebsd Freebsd, Fedoraproject Fedora.