Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 396105 (CVE-2011-4862) - <app-crypt/heimdal-1.5.1-r1 : telnetd Buffer Overflow Vulnerability (CVE-2011-4862)
Summary: <app-crypt/heimdal-1.5.1-r1 : telnetd Buffer Overflow Vulnerability (CVE-201...
Alias: CVE-2011-4862
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa]
Depends on:
Reported: 2011-12-26 17:36 UTC by Agostino Sarubbo
Modified: 2012-02-22 20:50 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2011-12-26 17:36:30 UTC
From secunia security advisory at $URL:

The vulnerability is caused due to a boundary error within the "encrypt_keyid()" function (appl/telnet/libtelnet/encrypt.c) of telnetd, which can be exploited to cause a buffer overflow by sending specially crafted commands to the server.

This is related to:
SA47397 ( )

The vulnerability is confirmed in version 1.5.1. Other versions may also be affected.

Comment 1 Eray Aslan gentoo-dev 2011-12-27 21:16:02 UTC
+*heimdal-1.5.1-r1 (27 Dec 2011)
+  27 Dec 2011; Eray Aslan <> +heimdal-1.5.1-r1.ebuild,
+  +files/CVE-2011-4862.patch, +files/heimdal_missing-include.patch:
+  security bump - bug #396105

@security: Please stabilize =app-crypt/heimdal-1.5.1-r1.  Thank you.
Comment 2 Agostino Sarubbo gentoo-dev 2011-12-27 23:17:46 UTC

Arches, please test and mark stable:
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"
Comment 3 Agostino Sarubbo gentoo-dev 2011-12-28 00:21:27 UTC

/etc/init.d/heimdal-kpasswdd returns crashed status after start, I guess is not expected, 

Please tell me if you prefer take a look if it works on a way different to other bug( e.g. irc )
Comment 4 Agostino Sarubbo gentoo-dev 2011-12-28 00:23:39 UTC
Missing anyway the following rdep:

Comment 5 Agostino Sarubbo gentoo-dev 2011-12-28 08:18:58 UTC
(In reply to comment #3)
> /etc/init.d/heimdal-kpasswdd returns crashed status after start, I guess is not
> expected, 

Eras said on irc that is expected if kerberos is not configured properly

amd64 stable
Comment 6 Eray Aslan gentoo-dev 2011-12-28 09:04:50 UTC
rdeps added.  Thanks.

For the record, kpasswdd will crash if kerberos is not configured.  Known problem/bug.
Comment 7 Mark Loeser (RETIRED) gentoo-dev 2011-12-29 20:20:50 UTC
ppc/ppc64 done
Comment 8 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2012-01-04 18:16:16 UTC
x86 stable
Comment 9 Raúl Porcel (RETIRED) gentoo-dev 2012-01-08 15:55:28 UTC
alpha/arm/ia64/m68k/s390/sh/sparc stable
Comment 10 Jeroen Roovers (RETIRED) gentoo-dev 2012-01-17 17:23:37 UTC
Stable for HPPA (bug #396105 will be solved later, and can be worked around with USE=-X, which should not be a huge problem since most HPPA users won't be using X much anyway).
Comment 11 Agostino Sarubbo gentoo-dev 2012-01-17 19:56:14 UTC
New glsa draft filed. Thanks everyone.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2012-02-22 20:50:01 UTC
This issue was resolved and addressed in
 GLSA 201202-05 at
by GLSA coordinator Sean Amoss (ackle).