CVE-2011-4862 in the critical feed json
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and…
published 2011-12-25 14 y ago modified 2026-06-16 4 mo ago also EUVD-2011-4779
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 95.1%
- EPSS 95.1% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 6
- Metasploit, Exploit-DB
Summary
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Patch / fix
- gnu inetutils 1.9
- krb5 Debian 14, Debian 13, Debian 12 1.8+dfsg~aa+r23527-1
- heimdal Debian 14, Debian 13, Debian 12 1.5.dfsg.1-1
- inetutils Debian 14, Debian 13, Debian 12 2:1.8-6
debian advisories DEBIAN-CVE-2011-4862
- krb5 RHEL 4 1.3.4-65.el4
- krb5 RHEL 5 1.6.1-63.el5_7
- krb5-libs RHEL 4 1.3.4-65.el4
- krb5-libs RHEL 5 1.6.1-63.el5_7
- krb5-server RHEL 4 1.3.4-65.el4
- krb5-server RHEL 5 1.6.1-63.el5_7
- krb5-server-ldap RHEL 5 1.6.1-63.el5_7
- krb5-workstation RHEL 4 1.3.4-65.el4
red hat advisories RHSA-2011:1851RHSA-2011:1854RHSA-2011:1853RHSA-2011:1852
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2011-4862 updated cvss 8.3
krb5: telnet client and server encrypt_keyid heap-based buffer overflow
-
Red Hat Enterprise Linux (v. 5 server) krb5 1.6.1-63.el5_7, krb5-libs 1.6.1-63.el5_7, krb5-server 1.6.1-63.el5_7, krb5-server-ldap 1.6.1-63.el5_7, krb5-workstation 1.6.1-63.el5_7fixed: vendor fix RHSA-2011:1851
-
Red Hat Enterprise Linux AS (v. 3 ELS) krb5 1.2.7-73, krb5-libs 1.2.7-73, krb5-server 1.2.7-73, krb5-workstation 1.2.7-73fixed: vendor fix RHSA-2011:1853
-
Red Hat Enterprise Linux AS version 4 krb5 1.3.4-65.el4, krb5-libs 1.3.4-65.el4, krb5-server 1.3.4-65.el4, krb5-workstation 1.3.4-65.el4 Red Hat Enterprise Linux Desktop (v. 5 client) krb5 1.6.1-63.el5_7, krb5-libs 1.6.1-63.el5_7, krb5-workstation 1.6.1-63.el5_7fixed: vendor fix RHSA-2011:1851
-
Red Hat Enterprise Linux Desktop (v. 6) krb5-appl 1.0.1-7.el6_2, krb5-appl-clients 1.0.1-7.el6_2, krb5-appl-servers 1.0.1-7.el6_2fixed: vendor fix RHSA-2011:1852
-
Red Hat Enterprise Linux Desktop version 4 krb5 1.3.4-65.el4, krb5-libs 1.3.4-65.el4, krb5-server 1.3.4-65.el4, krb5-workstation 1.3.4-65.el4fixed: vendor fix RHSA-2011:1851
-
Red Hat Enterprise Linux ES (v. 3 ELS) krb5 1.2.7-73, krb5-libs 1.2.7-73, krb5-server 1.2.7-73, krb5-workstation 1.2.7-73fixed: vendor fix RHSA-2011:1853
-
Red Hat Enterprise Linux ES version 4 krb5 1.3.4-65.el4, krb5-libs 1.3.4-65.el4, krb5-server 1.3.4-65.el4, krb5-workstation 1.3.4-65.el4fixed: vendor fix RHSA-2011:1851
-
Red Hat Enterprise Linux EUS (v. 5.6 server) krb5 1.6.1-55.el5_6.3, krb5-libs 1.6.1-55.el5_6.3, krb5-server 1.6.1-55.el5_6.3, krb5-server-ldap 1.6.1-55.el5_6.3, krb5-workstation 1.6.1-55.el5_6.3fixed: vendor fix RHSA-2011:1853
show 6 moreshow fewer
-
Red Hat Enterprise Linux HPC Node (v. 6) krb5-appl 1.0.1-7.el6_2, krb5-appl-clients 1.0.1-7.el6_2, krb5-appl-servers 1.0.1-7.el6_2fixed: vendor fix RHSA-2011:1852
-
Red Hat Enterprise Linux Long Life (v. 5.3 server) krb5 1.6.1-31.el5_3.5, krb5-libs 1.6.1-31.el5_3.5, krb5-server 1.6.1-31.el5_3.5, krb5-workstation 1.6.1-31.el5_3.5fixed: vendor fix RHSA-2011:1853
-
Red Hat Enterprise Linux Server (v. 6) krb5-appl 1.0.1-7.el6_2, krb5-appl-clients 1.0.1-7.el6_2, krb5-appl-servers 1.0.1-7.el6_2fixed: vendor fix RHSA-2011:1852
-
Red Hat Enterprise Linux Server EUS (v. 6.0) krb5-appl 1.0.1-1.el6_0.1, krb5-appl-clients 1.0.1-1.el6_0.1, krb5-appl-servers 1.0.1-1.el6_0.1 Red Hat Enterprise Linux Server EUS (v. 6.1) krb5-appl 1.0.1-2.el6_1.3, krb5-appl-clients 1.0.1-2.el6_1.3, krb5-appl-servers 1.0.1-2.el6_1.3fixed: vendor fix RHSA-2011:1854
-
Red Hat Enterprise Linux Workstation (v. 6) krb5-appl 1.0.1-7.el6_2, krb5-appl-clients 1.0.1-7.el6_2, krb5-appl-servers 1.0.1-7.el6_2fixed: vendor fix RHSA-2011:1852
-
Red Hat Enterprise Linux WS version 4 krb5 1.3.4-65.el4, krb5-libs 1.3.4-65.el4, krb5-server 1.3.4-65.el4, krb5-workstation 1.3.4-65.el4 Red Hat RHEL Desktop Workstation (v. 5 client) krb5 1.6.1-63.el5_7, krb5-server 1.6.1-63.el5_7, krb5-server-ldap 1.6.1-63.el5_7fixed: vendor fix RHSA-2011:1851
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/freebsd/telnet/telnet_encrypt_keyid)
- Published
Exploit prediction
95.06% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit exploit/freebsd/telnet/telnet_encrypt_keyid FreeBSD Telnet Service Encryption Key ID Buffer Overflow metasploit exploit, great rank, 2011-12-23
- Metasploit exploit/linux/telnet/telnet_encrypt_keyid Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow metasploit exploit, great rank, 2011-12-23
- Metasploit auxiliary/scanner/telnet/telnet_encrypt_overflow Telnet Service Encryption Key ID Overflow Detection metasploit auxiliary, normal rank
- EDB-18369 FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit) remote, 2012-01-14
- EDB-18368 Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit) remote, 2012-01-14
- EDB-18280 TelnetD encrypt_keyid - Function Pointer Overwrite remote, 2011-12-26
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
git.savannah.gnu.org
/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592
patch, third-party-advisory
-
security.freebsd.org
/patches/SA-11:08/telnetd.patch
patch, vendor-advisory
-
web.mit.edu
/kerberos/www/advisories/MITKRB5-SA-2011-008.txt
patch, vendor-advisory
-
exploit-db.com
/exploits/18280/
exploit, third-party-advisory, vdb-entry
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00010.html
vendor-advisory, mailing-list, third-party-advisory
-
debian.org
/security/2011/dsa-2375
vendor-advisory, third-party-advisory
-
redhat.com
/support/errata/RHSA-2011-1854.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00004.html
vendor-advisory, mailing-list, third-party-advisory
-
debian.org
/security/2011/dsa-2372
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2012-January/071640.html
vendor-advisory, third-party-advisory
-
security.freebsd.org
/advisories/FreeBSD-SA-11:08.telnetd.asc
vendor-advisory, mitigation
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00005.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2012-January/071627.html
vendor-advisory, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2011:195
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00007.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00011.html
vendor-advisory, mailing-list, third-party-advisory
-
redhat.com
/support/errata/RHSA-2011-1852.html
vendor-advisory, third-party-advisory
-
redhat.com
/support/errata/RHSA-2011-1853.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00014.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00002.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2012-01/msg00015.html
vendor-advisory, mailing-list, third-party-advisory
-
redhat.com
/support/errata/RHSA-2011-1851.html
vendor-advisory, third-party-advisory
-
debian.org
/security/2011/dsa-2373
vendor-advisory, third-party-advisory
-
lists.freebsd.org
/pipermail/freebsd-security/2011-December/006120.html
mailing-list, vendor-advisory
-
lists.freebsd.org
/pipermail/freebsd-security/2011-December/006118.html
mailing-list, vendor-advisory
-
lists.freebsd.org
/pipermail/freebsd-security/2011-December/006117.html
mailing-list, vendor-advisory
-
lists.freebsd.org
/pipermail/freebsd-security/2011-December/006119.html
mailing-list, vendor-advisory
-
secunia.com
/advisories/47399
third-party-advisory
-
archives.neohapsis.com
/archives/bugtraq/2011-12/0172.html
mailing-list, broken-link
-
secunia.com
/advisories/47359
third-party-advisory
-
secunia.com
/advisories/47374
third-party-advisory
-
osvdb.org
/78020
vdb-entry, broken-link
-
securitytracker.com
/id?1026463
vdb-entry
-
secunia.com
/advisories/47341
third-party-advisory
-
secunia.com
/advisories/47357
third-party-advisory
-
secunia.com
/advisories/46239
third-party-advisory
-
secunia.com
/advisories/47397
third-party-advisory
-
secunia.com
/advisories/47373
third-party-advisory
-
secunia.com
/advisories/47441
third-party-advisory
-
secunia.com
/advisories/47348
third-party-advisory
-
securitytracker.com
/id?1026460
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2011-4862
- NVD CVE-2011-4862
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.