Description
KTH Kerberos IV and Kerberos V (Heimdal) for Telnet clients do not encrypt connections if the server does not support the requested encryption, which allows remote attackers to read communications via a man-in-the-middle attack.
References
- http://josefsson.org/ktelnet/kerberos-telnet.html
- kth-kerberos-unencrypted-connection(10640) vdb-entry
- VU#390280 third-party-advisory