Buffer overflow in FreeBSD - CVE-2011-4862
Published: December 28, 2016 / Updated: July 15, 2020
Vulnerability identifier: #VU3031
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-4862
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to buffer overflow in the encrypt_keyid() function of telnetd. A remote attacker can send a very large encryption key to telnetd daemon, trigger buffer overflow and execute arbitrary code with root privileges.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
The weakness exists due to buffer overflow in the encrypt_keyid() function of telnetd. A remote attacker can send a very large encryption key to telnetd daemon, trigger buffer overflow and execute arbitrary code with root privileges.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Affected software
FreeBSD
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
heimdal (Alpine package)
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
heimdal (Alpine package)
How to mitigate CVE-2011-4862
Update the latest version from vendor's website:
http://security.FreeBSD.org/patches/SA-11:08/telnetd.patch
http://security.FreeBSD.org/patches/SA-11:08/telnetd.patch.asc
http://security.FreeBSD.org/patches/SA-11:08/telnetd.patch
http://security.FreeBSD.org/patches/SA-11:08/telnetd.patch.asc
heimdal (Alpine package) - update to 1.3.3-r3
Links to Public Exploits and PoC-codes
- Exploit #2189 - Exploits (Place where I share my Exploits for Knowns CVEs and Zero-Days... All of it coded by me!) (March 18, 2020)
- Exploit #1896 - GO-CVE-2011-4862 (Go Exploit for CVE-2011-4862) (March 18, 2020)
- Exploit #19 - Telnet Service Encryption Key ID Overflow Detection (March 18, 2020)
- Exploit #666 - FreeBSD Telnet Service - Encryption Key ID Buffer Overflow (Metasploit) (March 18, 2020)
- Exploit #667 - Linux BSD-derived Telnet Service Encryption Key ID - Buffer Overflow (Metasploit) (March 18, 2020)
- Exploit #668 - TelnetD encrypt_keyid - Function Pointer Overwrite (March 18, 2020)
- Exploit #1803 - Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow (March 18, 2020)
- Exploit #1846 - FreeBSD Telnet Service Encryption Key ID Buffer Overflow (March 18, 2020)
External References
Related Security Bulletins
- Remote code execution in FreeBSD
- Debian update for krb5, krb5-appl
- Debian update for inetutils
- Debian update for heimdal
- Gentoo update for Heimdal
- SUSE Linux update for heimdal
- SUSE Linux update for heimdal
- Red Hat update for krb5-appl
- Red Hat update for krb5
- Buffer overflow in heimdal (Alpine package)