MIT Kerberos krb5 Telnet Daemon and Client Buffer Overflow Vulnerability
Last Update Date:
4 Jan 2012 11:16
Release Date:
4 Jan 2012
4851
Views
RISK: Medium Risk
TYPE: Servers - Other Servers
A vulnerability has been identified in the telnet daemon (telnetd) and telnet client of MIT Kerberos krb5, which can be exploited by unauthenticated remote attacker to cause a buffer overflow and probably execute arbitrary code with the privileges of the telnet daemon.
Impact
- Elevation of Privilege
System / Technologies affected
- MIT krb5 prior to krb5-1.8
- MIT krb5-appl prior to krb5-1.0.3
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- Workaround:
Disable telnet and use a more secure remote login solution, such as SSH. - The krb5-appl-1.0.3 release contains a fix for this vulnerability. If running an earlier release, apply patch:
http://web.mit.edu/kerberos/advisories/2011-008-patch.txt
Vulnerability Identifier
Source
Related Link
Share with