CVE-2011-4862
published 2011-12-25CVE-2011-4862: Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal…
PriorityP181critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
95.10%
99.9th percentile
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ironport_appliances_telnet | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | heimdal | < heimdal 1.5.dfsg.1-1 (bookworm) | heimdal 1.5.dfsg.1-1 (bookworm) |
| debian | inetutils | < heimdal 1.5.dfsg.1-1 (bookworm) | heimdal 1.5.dfsg.1-1 (bookworm) |
| debian | krb5 | < heimdal 1.5.dfsg.1-1 (bookworm) | heimdal 1.5.dfsg.1-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| freebsd | freebsd | 7.3 – 9.0 | — |
| gnu | inetutils | < 1.9 | 1.9 |
| gnu | inetutils | >= 0 < 2:1.8-6 | 2:1.8-6 |
| gnu | inetutils | >= 0 < 2:1.8-6 | 2:1.8-6 |
| gnu | inetutils | >= 0 < 2:1.8-6 | 2:1.8-6 |
| gnu | inetutils | >= 0 < 2:1.8-6 | 2:1.8-6 |
| heimdal_project | heimdal | <= 1.5.1 | — |
| heimdal_project | heimdal | >= 0 < 1.5.dfsg.1-1 | 1.5.dfsg.1-1 |
| heimdal_project | heimdal | >= 0 < 1.5.dfsg.1-1 | 1.5.dfsg.1-1 |
| heimdal_project | heimdal | >= 0 < 1.5.dfsg.1-1 | 1.5.dfsg.1-1 |
| heimdal_project | heimdal | >= 0 < 1.5.dfsg.1-1 | 1.5.dfsg.1-1 |
| mit | krb5 | >= 0 < 1.8+dfsg~aa+r23527-1 | 1.8+dfsg~aa+r23527-1 |
| mit | krb5 | >= 0 < 1.8+dfsg~aa+r23527-1 | 1.8+dfsg~aa+r23527-1 |
| mit | krb5 | >= 0 < 1.8+dfsg~aa+r23527-1 | 1.8+dfsg~aa+r23527-1 |
| mit | krb5 | >= 0 < 1.8+dfsg~aa+r23527-1 | 1.8+dfsg~aa+r23527-1 |
| mit | krb5-appl | <= 1.0.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xff\xfa\x26\x00\x01\x01\x12\x13\x14\x15\x16\x17\x18\x19\xff\xf0
bytes↗
\xff\xfa\x26\x07
bytes↗
\xff\xfa\x26\x02\x01
bytes↗
\xeb\x76
bytes↗
\xeb\x46
bytes↗
\x31\xc0\x50\xb0\x17\x50\xcd\x80\x50\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x50\x54\x53\x50\xb0\x3b\xcd\x80
bytes↗
\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80
bytes↗
\xff\xfa\x26\x00\x01\x01\x12\x13\x14\x15\x16\x17\x18\x19\xff\xf0
bytes↗
\xff\xfa\x26\x07
- →Detect exploit by matching the telnet ENCRYPT SUPPORT suboption initiation sequence (IAC SB ENCRYPT SUPPORT ... IAC SE) followed immediately by an oversized ENCRYPT ENC_KEYID suboption (IAC SB ENCRYPT ENC_KEYID <400-byte key> IAC SE) on port 23. ↗
- →Flag any telnet session where the ENCRYPT ENC_KEYID suboption payload (\xff\xfa\x26\x07) is followed by more than 64 bytes before the IAC SE (\xff\xf0) terminator, as MAXKEYLEN is defined as 63 bytes. ↗
- →The exploit sends the malicious payload twice in sequence; detecting two rapid identical oversized ENC_KEYID suboptions from the same source within 500ms is a strong indicator of exploitation. ↗
- →Look for the short-jump NOP sled marker bytes \xeb\x76 at offset 0 of the ENC_KEYID key data, which is characteristic of both the Linux and FreeBSD Metasploit exploit modules. ↗
- →The exploit requires the target to respond with \xff\xfa\x26\x02\x01 (IAC SB ENCRYPT IS DES_CFB64) to confirm encryption support before sending the overflow; absence of this response causes the exploit to abort. ↗
- →The C exploit uses a brute-force loop with a configurable delay (BRUTE_TOUT) and sends the string 'echo pikachu' to verify shell access; monitor for this string on telnet sessions. ↗
- →Use the Metasploit auxiliary scanner module telnet_encrypt_overflow to detect vulnerable telnetd instances before exploitation. ↗
- ·The vulnerability only affects BSD-derived telnetd implementations (inetutils, krb5-telnet, Heimdal, FreeBSD telnetd). Most Linux distributions ship NetKit-derived telnetd which is NOT affected. ↗
- ·The exploit requires that the telnetd instance has encryption support compiled in and enabled; if the server does not respond with the encryption acknowledgement, the exploit aborts. ↗
- ·The brute-force delay constant BRUTE_TOUT must be tuned based on the target inetd connection rate limit (e.g., 900000µs for 60 conn/min, 1500000µs for 40 conn/min) to avoid triggering connection throttling. ↗
- ·The Telnet protocol requires 0xff bytes in the payload to be escaped as 0xff 0xff; the exploit handles this automatically, which may affect byte-pattern matching in IDS signatures. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vulncheck10.0CRITICAL
vendor_cisco10.0CRITICAL
vendor_debian10.0HIGH
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware ESXi and ESX address several security issues
vendor_vmware·2012-03-29·CVSS 8.3
CVE-2011-2482 [HIGH] VMware ESXi and ESX address several security issues
VMSA-2012-0006: VMware ESXi and ESX address several security issues
a. VMware ROM Overwrite Privilege Escalation A flaw in the way port-based I/O is handled allows for modifying Read-Only Memory that belongs to the Virtual DOS Machine. Exploitation of this issue may lead to privilege escalation on Guest Operating Systems that run Windows 2000, Windows XP 32-bit, Windows Server 2003 32-bit or Windows Server 2003 R2 32-bit. VMware would like to thank Derek Soeder of Ridgeway Internet Security, L.L.C. for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-1515 this issues. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product
Cisco
Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
vendor_cisco·2012-01-26·CVSS 10.0
CVE-2011-4862 [CRITICAL] Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
Cisco AsyncOS Software for Cisco Web Security Appliance (WSA), Cisco Email Security Appliance (ESA), and Cisco Content Security Management Appliance (SMA) contain a vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code with elevated privileges.
Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
Note: This security advisory has been updated to include important information about Cisco WSA
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120126-ironport
Red Hat
krb5: telnet client and server encrypt_keyid heap-based buffer overflow
vendor_redhat·2011-12-25·CVSS 10.0
CVE-2011-4862 [CRITICAL] CWE-130 krb5: telnet client and server encrypt_keyid heap-based buffer overflow
krb5: telnet client and server encrypt_keyid heap-based buffer overflow
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Statement: A buffer overflow flaw was found in the MIT krb5 telnet daemon (telnetd) as shipped with all supported versions of Red Hat Enterprise Linux. A remote attacker who can access the telnet port of a target machine could use this flaw to execute arbitrary code as root.
While we are aware of public exploits for this issue that include targets for Red Hat Enterprise Linux 3, we ar
BSD
FreeBSD-SA-11:08.telnetd: telnetd code execution vulnerability
bsd_advisories·2011-12-23·CVSS 10.0
CVE-2011-4862 [CRITICAL] FreeBSD-SA-11:08.telnetd: telnetd code execution vulnerability
FreeBSD-SA-11:08.telnetd Security Advisory
The FreeBSD Project
Topic: telnetd code execution vulnerability
Category: core
Module: contrib
Announced: 2011-12-23
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-23 15:00:37 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-23 15:00:37 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-23 15:00:37 UTC (RELENG_9, 9.0-STABLE)
2011-12-23 15:00:37 UTC (RELENG_9_0, 9.0-RELEASE)
CVE Name: CVE-2011-4862
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, p
Debian
CVE-2011-4862: heimdal - Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MI...
vendor_debian·2011·CVSS 10.0
CVE-2011-4862 [CRITICAL] CVE-2011-4862: heimdal - Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MI...
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Scope: local
bookworm: resolved (fixed in 1.5.dfsg.1-1)
bullseye: resolved (fixed in 1.5.dfsg.1-1)
forky: resolved (fixed in 1.5.dfsg.1-1)
sid: resolved (fixed in 1.5.dfsg.1-1)
trixie: resolved (fixed in 1.5.dfsg.1-1)
Cisco
Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
vendor_cisco
CVE-2011-4862 Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
CVE-2011-4862: Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) , Cisco Email Security Appliance (ESA), and Cisco Content Security Management Appliance (SMA) contain a vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code with elevated privileges. Cisco has released software updates that address this vulnerability.
Bug IDs: CSCuo90523, CSCzv32432, CSCzv44580, CSCzv32432, CSCzv44580
GHSA
GHSA-x8cr-m6vm-pqh4: Buffer overflow in libtelnet/encrypt
ghsa_unreviewed·2022-05-13
CVE-2011-4862 [HIGH] CWE-120 GHSA-x8cr-m6vm-pqh4: Buffer overflow in libtelnet/encrypt
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
OSV
CVE-2011-4862: Buffer overflow in libtelnet/encrypt
osv·2011-12-25·CVSS 10.0
CVE-2011-4862 [CRITICAL] CVE-2011-4862: Buffer overflow in libtelnet/encrypt
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
VulnCheck
GNU inetutils Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
vulncheck·2011·CVSS 10.0
CVE-2011-4862 [CRITICAL] GNU inetutils Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
GNU inetutils Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Affected: GNU inetutils
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html; https://www.cve.org/CVERecord?id=CVE-2011-4862
Exploit PoC: https://vulncheck.com/xdb/
No detection rules found.
Exploit-DB
Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit)
exploitdb·2012-01-14
CVE-2011-4862 Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit)
Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit)
---
##
# $Id: $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the encryption option handler of the
Linux BSD-derived telnet service (inetutils or krb5-telnet). Most Linux distributions
use NetKit-derived telnet daemons, so this flaw only applies to a small subset of
Linux systems running telnetd.
},
'Author' => [ 'Jaime
Exploit-DB
FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit)
exploitdb·2012-01-14
CVE-2011-4862 FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit)
FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit)
---
##
# $Id: $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'FreeBSD Telnet Service Encryption Key ID Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in the encryption option handler of the
FreeBSD telnet service.
},
'Author' => [ 'Jaime Penalba Estebanez ', 'Brandon Perry ', 'Dan Rosenberg', 'hdm' ],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2011-4862'],
['OSVDB', '78020'],
['BID', '51182'],
['URL', 'http://www.exploit-db.c
Exploit-DB
TelnetD encrypt_keyid - Function Pointer Overwrite
exploitdb·2011-12-26
CVE-2011-4862 TelnetD encrypt_keyid - Function Pointer Overwrite
TelnetD encrypt_keyid - Function Pointer Overwrite
---
/***************************************************************************
* telnetd-encrypt_keyid.c
*
* Mon Dec 26 20:37:05 CET 2011
*
* Copyright 2011 Jaime Penalba Estebanez (NighterMan)
* Copyright 2011 Gonzalo J. Carracedo (BatchDrake)
*
* [email protected] - [email protected]
* [email protected] - [email protected]
*
* ______ __ ________
* / __ / /_/ / _____/
* / /_/ /______________\ \_____________
* / ___ / __ / / __ / \ \/ _ \/ __/
* / / / /_/ / / / / /___/ / __/ /__
* ____/__/____\__,_/_/_/ /_/______/\___/\____/____
*
*
****************************************************************************/
/*
*
* Usage:
*
* $ gcc exploit.c -o exploit
*
* $ ./exploit 127.0.0.1 23 1
* [] Telnet initial encryption mode
Exploit-DB
Douran 3.9.7.8 - File Download/Source Code Disclosure
exploitdb·2011-03-20
CVE-2011-1569 Douran 3.9.7.8 - File Download/Source Code Disclosure
Douran 3.9.7.8 - File Download/Source Code Disclosure
---
# Title: [Douran Portal File Download/Source Code Disclosure Vulnerability]
# Date of Publishing: [16 March 2010]
# Application Name: [Douran Portal]
# Version: [3.9.7.8]
# Impact: [Medium]
# Vendor: www.douran.com
# Link: http://douran.com/HomePage.aspx?TabID=4862
# Vendor Response(s): They didn't respond to the emails.
# Credit to: AJAX Security Team
# Finder(s):
- HUrr!c4nE! (bl4ck.k3yv4n [at] yahoo [dot] com) (ajaxtm.com)
- Soroush Dalili (Irsdl [at] yahoo [dot] com) (secproject.com)
# Description:
Regarding attack technique [1], it is possible to bypass the security protections of /download.aspx in Douran Portal and download the hosted files.
# PoC(s):
Try this first and see the access denied error: http://[HOST]/download
Metasploit
Telnet Service Encryption Key ID Overflow Detection
metasploit
Telnet Service Encryption Key ID Overflow Detection
Telnet Service Encryption Key ID Overflow Detection
Detect telnet services vulnerable to the encrypt option Key ID overflow (BSD-derived telnetd)
Metasploit
FreeBSD Telnet Service Encryption Key ID Buffer Overflow
metasploit
FreeBSD Telnet Service Encryption Key ID Buffer Overflow
FreeBSD Telnet Service Encryption Key ID Buffer Overflow
This module exploits a buffer overflow in the encryption option handler of the FreeBSD telnet service.
Metasploit
Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow
metasploit
Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow
Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow
This module exploits a buffer overflow in the encryption option handler of the Linux BSD-derived telnet service (inetutils or krb5-telnet). Most Linux distributions use NetKit-derived telnet daemons, so this flaw only applies to a small subset of Linux systems running telnetd.
http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.htmlhttp://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.htmlhttp://osvdb.org/78020http://secunia.com/advisories/46239http://secunia.com/advisories/47341http://secunia.com/advisories/47348http://secunia.com/advisories/47357http://secunia.com/advisories/47359http://secunia.com/advisories/47373http://secunia.com/advisories/47374http://secunia.com/advisories/47397http://secunia.com/advisories/47399http://secunia.com/advisories/47441http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.aschttp://security.freebsd.org/patches/SA-11:08/telnetd.patchhttp://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txthttp://www.debian.org/security/2011/dsa-2372http://www.debian.org/security/2011/dsa-2373http://www.debian.org/security/2011/dsa-2375http://www.exploit-db.com/exploits/18280/http://www.mandriva.com/security/advisories?name=MDVSA-2011:195http://www.redhat.com/support/errata/RHSA-2011-1851.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1852.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1853.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1854.htmlhttp://www.securitytracker.com/id?1026460http://www.securitytracker.com/id?1026463https://exchange.xforce.ibmcloud.com/vulnerabilities/71970http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.htmlhttp://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.htmlhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.htmlhttp://osvdb.org/78020http://secunia.com/advisories/46239http://secunia.com/advisories/47341http://secunia.com/advisories/47348http://secunia.com/advisories/47357http://secunia.com/advisories/47359http://secunia.com/advisories/47373http://secunia.com/advisories/47374http://secunia.com/advisories/47397http://secunia.com/advisories/47399http://secunia.com/advisories/47441http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.aschttp://security.freebsd.org/patches/SA-11:08/telnetd.patchhttp://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txthttp://www.debian.org/security/2011/dsa-2372http://www.debian.org/security/2011/dsa-2373http://www.debian.org/security/2011/dsa-2375http://www.exploit-db.com/exploits/18280/http://www.mandriva.com/security/advisories?name=MDVSA-2011:195http://www.redhat.com/support/errata/RHSA-2011-1851.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1852.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1853.htmlhttp://www.redhat.com/support/errata/RHSA-2011-1854.htmlhttp://www.securitytracker.com/id?1026460http://www.securitytracker.com/id?1026463https://exchange.xforce.ibmcloud.com/vulnerabilities/71970
2011-12-25
Published
Exploited in the wild