Sploitus

Exploit for Telnetd Encryption Key ID Code Execution

saint · 2012-02-11

Exploit Code

MARKDOWN36 lines
## https://sploitus.com/exploit?id=SAINT:26C6B8F3145835954FAFE01517775E67
Added: 02/11/2012  
CVE: CVE-2011-4862  
BID: 51182  
OSVDB: 78020  


### Background

Telnet is a network protocol used on the Internet or local area networks to provide a bidirectional interactive text-oriented communications facility using a virtual terminal connection. 

### Problem

The flaw is caused due to a boundary error within the "encrypt_keyid()" function (libtelnet/encrypt.c). This can be exploited to cause a buffer overflow via a long encryption key. 

### Resolution

Apply the vendor supplied patch for the target system or update FreeBSD/krb5. 

### References

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt   
http://thexploit.com/secdev/a-textbook-buffer-overflow-a-look-at-the-freebsd-telnetd-code/   


### Limitations

This exploit has been tested against telnetd on FreeBSD 8.0, FreeBSD 8.2, NetBSD 5.1 and Debian 6.0.2 Heimdal Server 1.5. 

### Platforms

FreeBSD 8.0  
FreeBSD 8.1  
FreeBSD 8.2  
NetBSD 5.1  
Linux / Debian