Stack overflow

telnetd has carried stack buffer overflows in its handling of Telnet options and protocol data, notably the encryption-option and telrcv code paths, reachable pre-authentication. On old Unix and embedded builds without stack protections, a crafted option sequence overflows a fixed buffer to execute code as root.

1 min di letturaaggiornato il 5 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

CVE-2011-4862 was a buffer overflow in libtelnet/encrypt.c used by specific BSD-derived Telnet daemons. The affected code copied a client-supplied encryption key into a fixed-size buffer without validating its length. Because this option was processed before authentication, a remote unauthenticated attacker could execute code with the privileges of the daemon, which was commonly root. The advisory covered named versions of FreeBSD and related Heimdal, MIT Kerberos applications, and GNU inetutils code; it was not a generic flaw in every Telnet server or embedded implementation.

bash
# identify the service and whether it supports the relevant encryption option
nmap -p23 -sV --script telnet-encryption <target>
# support is only a lead: confirm an affected product/version against the advisory

Exploitation notes#

  • The vulnerable encryption-key handling runs before authentication; successful exploitation inherits the daemon's privileges.
  • telnet-encryption detects option support only. Nmap explicitly states that the script does not test for CVE-2011-4862.
  • Confirm the exact implementation and version through inventory, package data, or vendor evidence; a banner may be insufficient.
  • Do not extend this CVE to BusyBox or vendor forks without evidence that they contain the affected code.

References#

PrecedenteFormat stringSuccessiva Enumeration