Description
Buffer overflow in the slc_add_reply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character (SLC) commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | heimdal | 0.6.3-10 | — |
| Debian 14 | krb5 | 1.3.6-2 | — |
| Debian 14 | netkit-telnet-ssl | 0.17.24+0.1-7.1 | — |
| Debian 13 | heimdal | 0.6.3-10 | — |
| Debian 13 | krb5 | 1.3.6-2 | — |
| Debian 13 | netkit-telnet-ssl | 0.17.24+0.1-7.1 | — |
| Debian 12 | heimdal | 0.6.3-10 | — |
| Debian 12 | krb5 | 1.3.6-2 | — |
| Debian 12 | netkit-telnet-ssl | 0.17.24+0.1-7.1 | — |
| Debian 3.0 | heimdal | 0.4e-7.woody.11 | DSA-765-1 |
| Debian 3.0 | krb4 | 1.1-8-2.4 | DSA-731-1 |
| Debian 3.0 | krb5 | 1.2.4-5woody8 | DSA-703-1 |
| Debian 3.0 | netkit-telnet | 0.17-18woody3 | DSA-697-1 |
| Debian 3.0 | netkit-telnet-ssl | 0.17.17+0.1-2woody4 | DSA-699-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | krb5 +4 | 1.3.4-12 | RHSA-2005:330 |
| RHEL 4 | telnet +1 | 1:0.17-31.EL4.2 | RHSA-2005:327 |
| RHEL 3 | krb5 +4 | 1.2.7-42 | RHSA-2005:330 |
| RHEL 3 | telnet +1 | 1:0.17-26.EL3.2 | RHSA-2005:327 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | telnet | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | telnet | No fix yet | — |
Advisories 7
- RHSA-2005:330 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:327 Red Hat Security Advisory: telnet security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-731-1 krb4 - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-765-1 heimdal - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-699-1 netkit-telnet-ssl - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-697-1 netkit-telnet - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-703-1 krb5 - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-731 vendor-advisory
- 12918 vdb-entry
- USN-224-1 vendor-advisory
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-001-telnet.txt
- 57755 vendor-advisory
- oval:org.mitre.oval:def:9708 vdb-entry signature
- DSA-703 vendor-advisory
- 101665 vendor-advisory
- DSA-699 vendor-advisory
- MDKSA-2005:061 vendor-advisory
- 14745 third-party-advisory
- RHSA-2005:327 vendor-advisory
- 20050328 Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability third-party-advisory
- GLSA-200503-36 vendor-advisory
- RHSA-2005:330 vendor-advisory
- DSA-697 vendor-advisory
- 57761 vendor-advisory
- VU#291924 third-party-advisory
- 101671 vendor-advisory
- 17899 third-party-advisory