Bug 396137 – <app-crypt/mit-krb5-appl-1.0.2-r1 : telnetd Buffer Overflow Vulnerability (CVE-2011-4862)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Eray Aslan 2011-12-26 21:36:48 UTC]

SUMMARY
=======

The telnet daemon (telnetd) in MIT krb5 (and in krb5-appl after the
applications were moved to a separate distribution for krb5-1.8) is
vulnerable to a buffer overflow.  The flaw does not require
authentication to exploit.  Exploit code is reported to be actively
used in the wild.

IMPACT
======

An unauthenticated remote attacker can cause a buffer overflow and
probably execute arbitrary code with the privileges of the telnet
daemon (normally root).


Reproducible: Always

[Comment 1 Eray Aslan 2011-12-26 21:40:16 UTC]

+*mit-krb5-appl-1.0.2-r1 (26 Dec 2011)
+
+  26 Dec 2011; Eray Aslan <[e-mail]> +mit-krb5-appl-1.0.2-r1.ebuild,
+  +files/CVE-2011-4862.patch:
+  security bump - bug #396137
+

@security:  Please stabilize =app-crypt/mit-krb5-appl-1.0.2-r1.  Thank you.

[Comment 2 Agostino Sarubbo 2011-12-26 22:33:05 UTC]

Thanks Eray.

Arches, please test and mark stable:
=app-crypt/mit-krb5-appl-1.0.2-r1
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"

[Comment 3 Agostino Sarubbo 2011-12-27 11:36:34 UTC]

@Eras, missing sys-libs/e2fsprogs-libs and sys-libs/ncurses as RDEPEND.


amd64 stable

[Comment 4 Eray Aslan 2011-12-27 12:02:23 UTC]

(In reply to comment #3)
> @Eras, missing sys-libs/e2fsprogs-libs and sys-libs/ncurses as RDEPEND.

Indeed.  Added.  Thank you.

[Comment 5 Mark Loeser (RETIRED) 2011-12-27 18:33:56 UTC]

ppc/ppc64 done

[Comment 6 Jeroen Roovers (RETIRED) 2011-12-27 20:40:56 UTC]

Stable for HPPA.

[Comment 7 GLSAMaker/CVETool Bot 2011-12-29 13:14:16 UTC]

CVE-2011-4862 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4862):
  Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through
  9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier,
  and Heimdal 1.5.1 and earlier allows remote attackers to execute arbitrary
  code via a long encryption key, as exploited in the wild in December 2011.

[Comment 8 Paweł Hajdan, Jr. (RETIRED) 2012-01-04 17:27:50 UTC]

x86 stable

[Comment 9 Raúl Porcel (RETIRED) 2012-01-08 17:16:05 UTC]

alpha/arm/ia64/m68k/s390/sh/sparc stable

[Comment 10 Sean Amoss (RETIRED) 2012-01-08 17:29:33 UTC]

Thanks, everyone. Filed GLSA request.

[Comment 11 GLSAMaker/CVETool Bot 2012-01-23 20:39:12 UTC]

This issue was resolved and addressed in
 GLSA 201201-14 at http://security.gentoo.org/glsa/glsa-201201-14.xml
by GLSA coordinator Sean Amoss (ackle).