Description
Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.8.3+dfsg-4 | — |
| Debian 13 | krb5 | 1.8.3+dfsg-4 | — |
| Debian 12 | krb5 | 1.8.3+dfsg-4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | krb5 +4 | 1.2.7-47 | RHSA-2005:562 |
Advisories 1
- RHSA-2005:562 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- APPLE-SA-2006-08-01 vendor-advisory
- RHSA-2005:504 vendor-advisory
- 1014203 vdb-entry
- 13940 vdb-entry
- 57755 vendor-advisory
- ADV-2006-3101 vdb-entry
- 21253 third-party-advisory
- VU#800829 third-party-advisory
- 19289 vdb-entry
- RHSA-2005:562 vendor-advisory
- TA06-214A third-party-advisory
- oval:org.mitre.oval:def:11373 vdb-entry signature
- 101665 vendor-advisory
- oval:org.mitre.oval:def:1139 vdb-entry signature
- 20050614 Multiple Vendor Telnet Client Information Disclosure Vulnerability third-party-advisory
- 17135 third-party-advisory
- 57761 vendor-advisory
- 101671 vendor-advisory
- SUSE-SR:2005:016 vendor-advisory