Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade krb5-appl-serversUpgrade krb5-libsUpgrade krb5-develUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade krb5-appl-clients | Dec 1, 2016 | Dec 24, 2011 |
| Debian | — | Upgrade heimdalUpgrade krb5Upgrade inetutils | Jul 30, 2024 | Dec 25, 2011 |
| Freebsd | — | Upgrade FreeBSDUpgrade krb5-appl | Dec 10, 2025 | Dec 26, 2011 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5-appl.Upgrade app-crypt/heimdal. | Oct 30, 2017 | Dec 24, 2011 |
| Oracle Solaris | — | Upgrade network/telnet to version 0.5.11-0.175.0.4.0.4.1 on Solaris 11.0 | May 29, 2017 | Dec 24, 2011 |
| Oracle_linux | — | Upgrade krb5-appl-serversUpgrade krb5-appl-clientsUpgrade krb5-develUpgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-libs | Oct 16, 2024 | Dec 25, 2011 |
| Suse | — | Upgrade krb5-appl-clientsUpgrade krb5-serverUpgrade krb5-64bitUpgrade krb5-appl-clients-debuginfoUpgrade krb5-apps-clientsUpgrade krb5-x86Upgrade krb5-appl-serversUpgrade krb5-devel-32bitUpgrade krb5-develUpgrade krb5-apps-serversUpgrade krb5-devel-64bitUpgrade krb5-applUpgrade krb5-clientUpgrade krb5-32bitUpgrade krb5-appl-debugsourceUpgrade krb5-appl-servers-debuginfoUpgrade krb5 | Feb 17, 2015 | Dec 24, 2011 |
| Vmsa 2012 0006 | — | Upgrade VMware ESX 4.0 to build number 660575 | Aug 17, 2012 | Dec 24, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub