CVE-2011-4862
krb5 - buffer overflow
EPSS 92.4%
Description
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
How to fix CVE-2011-4862
To remediate CVE-2011-4862, upgrade the affected package to a fixed version below.
- Debian/heimdal—upgrade to 1.4.0~git20100726.dfsg.1-2+squeeze1 or later
- Debian/heimdal—upgrade to 1.5.dfsg.1-1 or later
- —upgrade to 2:1.8-6 or later
- —upgrade to 2:1.6-3.1+squeeze1 or later
- —upgrade to 1.8+dfsg~aa+r23527-1 or later
- —upgrade to 1.6.dfsg.4~beta1-5lenny7 or later
- —upgrade to 1:1.0.1-1.2 or later
Is CVE-2011-4862 being exploited?
Likely — EPSS is 92.4%, placing CVE-2011-4862 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.
Affected packages (7)
- from 0, < 1.4.0~git20100726.dfsg.1-2+squeeze1
- from 0, < 1.5.dfsg.1-1
- from 0, < 2:1.8-6
- from 0, < 2:1.6-3.1+squeeze1
- from 0, < 1.8+dfsg~aa+r23527-1
- from 0, < 1.6.dfsg.4~beta1-5lenny7
- from 0, < 1:1.0.1-1.2