{"id":"CVE-2011-4862","url":"https://www.cyber-defence.io/tools/cve/CVE-2011-4862","generatedAt":"2026-10-27T22:05:41.083Z","title":"Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute…","description":"Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.","published":"2011-12-25T01:55:02.000Z","lastModified":"2026-06-16T23:35:32.000Z","status":"Modified","sourceIdentifier":"secteam@freebsd.org","cvss":{"version":"2.0","score":10,"severity":"HIGH","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C"},"cwe":["CWE-120"],"affected":["gnu/inetutils","heimdal project/heimdal","mit/krb5-appl","freebsd/freebsd","fedoraproject/fedora","debian/debian linux","opensuse/opensuse","suse/linux enterprise desktop","suse/linux enterprise server","suse/linux enterprise software development kit"],"epss":{"score":0.95061,"percentile":0.99861,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":3,"verified":true,"firstPublished":"2011-12-26","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":18369,"kind":"exploit","title":"FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit)","url":"https://www.exploit-db.com/exploits/18369","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/bsd/remote/18369.rb","file":"exploits/bsd/remote/18369.rb","published":"2012-01-14","added":"2012-01-14","updated":"2012-01-14","author":"Metasploit","type":"remote","platform":"bsd","port":null,"verified":true,"codes":["CVE-2011-4862","OSVDB-78020"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":18368,"kind":"exploit","title":"Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit)","url":"https://www.exploit-db.com/exploits/18368","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/18368.rb","file":"exploits/linux/remote/18368.rb","published":"2012-01-14","added":"2012-01-14","updated":"2012-01-14","author":"Metasploit","type":"remote","platform":"linux","port":null,"verified":true,"codes":["CVE-2011-4862","OSVDB-78020"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":18280,"kind":"exploit","title":"TelnetD encrypt_keyid - Function Pointer Overwrite","url":"https://www.exploit-db.com/exploits/18280","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/18280.c","file":"exploits/linux/remote/18280.c","published":"2011-12-26","added":"2011-12-26","updated":"2016-12-05","author":"NighterMan & BatchDrake","type":"remote","platform":"linux","port":null,"verified":true,"codes":["CVE-2011-4862","OSVDB-78020"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.cominetutils-1.8.tar.gz","screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 95.1%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html","tags":["Broken Link"],"source":"secteam@freebsd.org"},{"url":"http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592","tags":["Patch","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html","tags":["Vendor Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html","tags":["Vendor Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html","tags":["Vendor Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html","tags":["Vendor Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html","tags":["Mailing List","Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://osvdb.org/78020","tags":["Broken Link"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/46239","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47341","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47348","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47357","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47359","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47373","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47374","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47397","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47399","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://secunia.com/advisories/47441","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc","tags":["Mitigation","Vendor Advisory"],"source":"secteam@freebsd.org"},{"url":"http://security.freebsd.org/patches/SA-11:08/telnetd.patch","tags":["Patch","Vendor Advisory"],"source":"secteam@freebsd.org"},{"url":"http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt","tags":["Patch","Vendor Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.debian.org/security/2011/dsa-2372","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.debian.org/security/2011/dsa-2373","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.debian.org/security/2011/dsa-2375","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.exploit-db.com/exploits/18280/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secteam@freebsd.org"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2011:195","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1851.html","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1852.html","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1853.html","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2011-1854.html","tags":["Third Party Advisory"],"source":"secteam@freebsd.org"},{"url":"http://www.securitytracker.com/id?1026460","tags":["Third Party Advisory","VDB Entry"],"source":"secteam@freebsd.org"},{"url":"http://www.securitytracker.com/id?1026463","tags":["Third Party Advisory","VDB Entry"],"source":"secteam@freebsd.org"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71970","tags":["Third Party Advisory","VDB Entry"],"source":"secteam@freebsd.org"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://osvdb.org/78020","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/46239","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-4862","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}