Memory corruption

Telnet server implementations have carried serious memory-corruption vulnerabilities reachable before or during authentication: stack buffer overflows and format-string flaws in option and environment handling. On old Unix telnetd and embedded builds, these give remote code execution, often as root, against a service that predates modern mitigations.

1 min di letturaaggiornato il 7 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

Beyond its protocol weaknesses, particular Telnet server implementations have contained memory-corruption vulnerabilities. One well-documented example is CVE-2011-4862 in the encryption-option code shared by affected FreeBSD, Heimdal, MIT Kerberos applications, and GNU inetutils releases. An unauthenticated client could supply an overlong encryption key that was copied into a fixed-size buffer, enabling code execution with the daemon's privileges. Exposure to Telnet or support for encryption does not by itself prove vulnerability: identify the implementation and affected version before drawing that conclusion.

bash
# fingerprint the telnetd implementation/version (banner, option negotiation)
nc <target> 23; nmap -p23 -sV <target>
# compare the implementation and version with a specific vendor advisory

Subtopics#

References#

PrecedentePassword brute forceSuccessiva Format string