Description
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | heimdal | 1.5.dfsg.1-1 | — |
| Debian 14 | inetutils | 2:1.8-6 | — |
| Debian 14 | krb5 | 1.8+dfsg~aa+r23527-1 | — |
| Debian 13 | heimdal | 1.5.dfsg.1-1 | — |
| Debian 13 | inetutils | 2:1.8-6 | — |
| Debian 13 | krb5 | 1.8+dfsg~aa+r23527-1 | — |
| Debian 12 | heimdal | 1.5.dfsg.1-1 | — |
| Debian 12 | inetutils | 2:1.8-6 | — |
| Debian 12 | krb5 | 1.8+dfsg~aa+r23527-1 | — |
| Debian 6.0 | heimdal | 1.4.0~git20100726.dfsg.1-2+squeeze1 | DSA-2372-1 |
| Debian 6.0 | inetutils | 2:1.6-3.1+squeeze1 | DSA-2373-1 |
| Debian 6.0 | krb5-appl | 1:1.0.1-1.2 | DSA-2375-1 |
| Debian 5.0 | heimdal | 1.2.dfsg.1-2.1+lenny1 | DSA-2372-1 |
| Debian 5.0 | inetutils | 2:1.5.dfsg.1-9+lenny1 | DSA-2373-1 |
| Debian 5.0 | krb5 | 1.6.dfsg.4~beta1-5lenny7 | DSA-2375-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | krb5-appl +2 | 1.0.1-7.el6_2 | RHSA-2011:1852 |
| RHEL 5 | krb5 +5 | 1.6.1-63.el5_7 | RHSA-2011:1851 |
| RHEL 4 | krb5 +4 | 1.3.4-65.el4 | RHSA-2011:1851 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 5 | krb5 +4 | 1.6.1-31.el5_3.5 | RHSA-2011:1853 |
| RHEL 6.1 EUS | krb5-appl +2 | 1.0.1-2.el6_1.3 | RHSA-2011:1854 |
| RHEL 6.0 EUS | krb5-appl +2 | 1.0.1-1.el6_0.1 | RHSA-2011:1854 |
| RHEL 5.6 EUS | krb5 +5 | 1.6.1-55.el5_6.3 | RHSA-2011:1853 |
| RHEL 3 ELS | krb5 +4 | 1.2.7-73 | RHSA-2011:1853 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 3 modules
-
Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow
exploit/linux/telnet/telnet_encrypt_keyid
-
FreeBSD Telnet Service Encryption Key ID Buffer Overflow
exploit/freebsd/telnet/telnet_encrypt_keyid
-
Telnet Service Encryption Key ID Overflow Detection
auxiliary/scanner/telnet/telnet_encrypt_overflow
Exploit-DB 3
- Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit) EDB-18368 · remote · Jan 14, 2012 · verified
- FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit) EDB-18369 · remote · Jan 14, 2012 · verified
- TelnetD encrypt_keyid - Function Pointer Overwrite EDB-18280 · remote · Dec 26, 2011 · verified
GitHub 3 repositories
-
hdbreaker/GO-CVE-2011-4862 ★ 5 · Feb 2, 2017
Go Exploit for CVE-2011-4862
-
appsecrani/CVE-2011-4862 ★ 1 · Feb 6, 2020
Final Project for Security and Privacy CS 600.443
-
lol-fi/cve-2011-4862 ★ 0 · Nov 28, 2018
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2011:1854 Red Hat Security Advisory: krb5-appl security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1852 Red Hat Security Advisory: krb5-appl security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1853 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1851 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2373-1 inetutils - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2372-1 heimdal - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2375-1 krb5 - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SU-2012:0042 vendor-advisory
- 47399 third-party-advisory
- DSA-2375 vendor-advisory
- RHSA-2011:1854 vendor-advisory
- SUSE-SU-2012:0018 vendor-advisory
- 20111226 MITKRB5-SA-2011-008 buffer overflow in telnetd [CVE-2011-4862] mailing-list
- DSA-2372 vendor-advisory
- 47359 third-party-advisory
- FEDORA-2011-17493 vendor-advisory
- [freebsd-security] 20111223 Merry Christmas from the FreeBSD Security Team mailing-list
- 47374 third-party-advisory
- [freebsd-security] 20111223 Merry Christmas from the FreeBSD Security Team mailing-list
- FreeBSD-SA-11:08 vendor-advisory
- openSUSE-SU-2012:0019 vendor-advisory
- FEDORA-2011-17492 vendor-advisory
- MDVSA-2011:195 vendor-advisory
- SUSE-SU-2012:0024 vendor-advisory
- SUSE-SU-2012:0050 vendor-advisory
- 78020 vdb-entry
- 1026463 vdb-entry
- [freebsd-security] 20111223 Merry Christmas from the FreeBSD Security Team mailing-list
- 47341 third-party-advisory
- RHSA-2011:1852 vendor-advisory
- RHSA-2011:1853 vendor-advisory
- openSUSE-SU-2012:0051 vendor-advisory
- http://security.freebsd.org/patches/SA-11:08/telnetd.patch
- 47357 third-party-advisory
- 46239 third-party-advisory
- SUSE-SU-2012:0010 vendor-advisory
- 47397 third-party-advisory
- 47373 third-party-advisory
- SUSE-SU-2012:0056 vendor-advisory
- [freebsd-security] 20111223 Merry Christmas from the FreeBSD Security Team mailing-list
- 47441 third-party-advisory
- http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt
- RHSA-2011:1851 vendor-advisory
- 18280 exploit
- 47348 third-party-advisory
- 1026460 vdb-entry
- DSA-2373 vendor-advisory
- multiple-telnetd-bo(71970) vdb-entry