Description
Heap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary code via responses that contain a large number of characters that require escaping, which consumers more memory than allocated.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | krb5 +4 | 1.3.4-12 | RHSA-2005:330 |
| RHEL 4 | telnet +1 | 1:0.17-31.EL4.2 | RHSA-2005:327 |
| RHEL 3 | krb5 +4 | 1.2.7-42 | RHSA-2005:330 |
| RHEL 3 | telnet +1 | 1:0.17-26.EL3.2 | RHSA-2005:327 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Multiple Vendor Telnet Client - Env_opt_add Heap Buffer Overflow EDB-25303 · dos · Mar 28, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2005:330 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:327 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-731-1 krb4 - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-703-1 krb5 - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-731 vendor-advisory
- USN-224-1 vendor-advisory
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-001-telnet.txt
- VU#341908 third-party-advisory
- 57755 vendor-advisory
- 12919 vdb-entry
- CLA-2005:962 vendor-advisory
- DSA-703 vendor-advisory
- 101665 vendor-advisory
- MDKSA-2005:061 vendor-advisory
- oval:org.mitre.oval:def:9640 vdb-entry signature
- 14745 third-party-advisory
- RHSA-2005:327 vendor-advisory
- RHSA-2005:330 vendor-advisory
- 57761 vendor-advisory
- 20050328 Multiple Telnet Client env_opt_add() Buffer Overflow Vulnerability third-party-advisory
- 101671 vendor-advisory
- 17899 third-party-advisory