NULL pointer dereference in Inetutils - GNU network utilities - CVE-2022-39028

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU67777

NULL pointer dereference in Inetutils - GNU network utilities - CVE-2022-39028

Published: September 30, 2022 / Updated: October 26, 2022


Vulnerability identifier: #VU67777
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-39028
CWE-ID: CWE-476
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in telnetd daemon. A remote attacker can trigger NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8 and crash telnetd.


Affected software

Inetutils - GNU network utilities
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Legacy Software
openSUSE Leap
openEuler
telnet-debuginfo
telnet-debugsource
telnet-help
telnet
krb5-appl-clients-debuginfo
krb5-appl-clients
krb5-appl-debugsource
krb5-appl-servers
krb5-appl-servers-debuginfo
telnet-server
telnet-server-debuginfo
inetutils (Ubuntu package)
inetutils-telnetd (Ubuntu package)
inetutils-tools (Ubuntu package)
PowerStore T
EMC Cloud Tiering Appliance
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM

How to mitigate CVE-2022-39028

Install update from vendor's website.

Inetutils - GNU network utilities - update to 2.4
telnet-debuginfo - addressed in versions 0.17-77, 0.17-79
telnet-debugsource - addressed in versions 0.17-77, 0.17-79
telnet-help - addressed in versions 0.17-77, 0.17-79
telnet - addressed in versions 0.17-77, 0.17-79
krb5-appl-clients-debuginfo - update to 1.0.3-3.9.1
krb5-appl-clients - update to 1.0.3-3.9.1
krb5-appl-debugsource - update to 1.0.3-3.9.1
krb5-appl-servers - update to 1.0.3-3.9.1
krb5-appl-servers-debuginfo - update to 1.0.3-3.9.1
telnet - addressed in versions 1.2-167.10.1, 1.2-150000.3.6.1
telnet-debuginfo - addressed in versions 1.2-167.10.1, 1.2-150000.3.6.1
telnet-debugsource - addressed in versions 1.2-167.10.1, 1.2-150000.3.6.1
telnet-server - addressed in versions 1.2-167.10.1, 1.2-150000.3.6.1
telnet-server-debuginfo - addressed in versions 1.2-167.10.1, 1.2-150000.3.6.1
inetutils (Ubuntu package) - addressed in versions 2:1.9.2-1ubuntu0.1~esm2, 2:1.9.4-1ubuntu0.1~esm3, 2:1.9.4-3ubuntu0.1+esm2, 2:1.9.4-11ubuntu0.2+esm1
inetutils-telnetd (Ubuntu package) - addressed in versions 2:1.9.4-11ubuntu0.2, 2:2.2-2ubuntu0.1, 2:2.4-2ubuntu1.1
inetutils-tools (Ubuntu package) - addressed in versions 2:1.9.4-11ubuntu0.2, 2:2.2-2ubuntu0.1, 2:2.4-2ubuntu1.1
PowerStore T - update to 3.5.0.1-2083289
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.8.0.1
EMC ViPR SRM - update to 4.8.0.1
EMC Cloud Tiering Appliance - update to 13.1.0.2.29

External References

Related Security Bulletins