CVE-2011-4862
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos...
10.0 HighPublic exploitFix available
CVE-2011-4862 is a high vulnerability (CVSS 10.0) in Freebsd, published December 25, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.1%, the 99th percentile. Fixed in heimdal 1.5.dfsg.1-1.
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
Exploit likelihood
95.1%Up 6.2 points since Feb 4, 2022
What each source reports
NVD Score used
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
- Record
CVE-2011-4862- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
- Record
CVE-2011-4862- Updated
- 2026-11-02
EUVDEUVD-2011-4779 No score
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
- Record
EUVD-2011-4779- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x8cr-m6vm-pqh4 No score
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos...
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
- Record
GHSA-x8cr-m6vm-pqh4- Weakness
- CWE-120
- Updated
- 2026-11-02
OSV No score
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
- Record
CVE-2011-4862- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4862 No score
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.
- Record
DEBIAN-CVE-2011-4862- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13497-1 No score
krb5-appl-clients-1.0.3-1.1 on GA media
These are all security issues fixed in the krb5-appl-clients-1.0.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13497-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
heimdalDebian:12 |
before 1.5.dfsg.1-1 | 1.5.dfsg.1-1 |
heimdalDebian:13 |
before 1.5.dfsg.1-1 | 1.5.dfsg.1-1 |
heimdalDebian:14 |
before 1.5.dfsg.1-1 | 1.5.dfsg.1-1 |
inetutilsDebian:12 |
before 2:1.8-6 | 2:1.8-6 |
inetutilsDebian:13 |
before 2:1.8-6 | 2:1.8-6 |
inetutilsDebian:14 |
before 2:1.8-6 | 2:1.8-6 |
krb5Debian:12 |
before 1.8+dfsg~aa+r23527-1 | 1.8+dfsg~aa+r23527-1 |
krb5Debian:13 |
before 1.8+dfsg~aa+r23527-1 | 1.8+dfsg~aa+r23527-1 |
krb5Debian:14 |
before 1.8+dfsg~aa+r23527-1 | 1.8+dfsg~aa+r23527-1 |
heimdalDebian:6.0 |
before 1.4.0~git20100726.dfsg.1-2+squeeze1, plus listed versions 1.4.0~git20100726.dfsg.1-11.4.0~git20100726.dfsg.1-2 |
1.4.0~git20100726.dfsg.1-2+squeeze1 |
Show 94 moreShow less
| Package | Affected | Fixed |
|---|---|---|
heimdalDebian:5.0 |
before 1.2.dfsg.1-2.1+lenny1, plus listed versions 1.2.dfsg.1-2.11.2.dfsg.1-2.1+hurd.1 |
1.2.dfsg.1-2.1+lenny1 |
inetutilsDebian:6.0 |
before 2:1.6-3.1+squeeze1, plus listed versions 2:1.6-3.1 |
2:1.6-3.1+squeeze1 |
inetutilsDebian:5.0 |
before 2:1.5.dfsg.1-9+lenny1, plus listed versions 2:1.5.dfsg.1-9 |
2:1.5.dfsg.1-9+lenny1 |
krb5Debian:5.0 |
before 1.6.dfsg.4~beta1-5lenny7, plus listed versions 1.6.dfsg.4~beta1-51.6.dfsg.4~beta1-5lenny11.6.dfsg.4~beta1-5lenny21.6.dfsg.4~beta1-5lenny31.6.dfsg.4~beta1-5lenny41.6.dfsg.4~beta1-5lenny6 |
1.6.dfsg.4~beta1-5lenny7 |
krb5-applDebian:6.0 |
before 1:1.0.1-1.2, plus listed versions 1:1.0.1-11:1.0.1-1.1 |
1:1.0.1-1.2 |
krb5Red Hat:enterprise_linux:4::as |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-develRed Hat:enterprise_linux:4::as |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-libsRed Hat:enterprise_linux:4::as |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-serverRed Hat:enterprise_linux:4::as |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-workstationRed Hat:enterprise_linux:4::as |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5Red Hat:enterprise_linux:4::desktop |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-develRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-libsRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-serverRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-workstationRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5Red Hat:enterprise_linux:4::es |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-develRed Hat:enterprise_linux:4::es |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-libsRed Hat:enterprise_linux:4::es |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-serverRed Hat:enterprise_linux:4::es |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-workstationRed Hat:enterprise_linux:4::es |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5Red Hat:enterprise_linux:4::ws |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-develRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-libsRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-serverRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5-workstationRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-65.el4 | 0:1.3.4-65.el4 |
krb5Red Hat:enterprise_linux:5::client |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-debuginfoRed Hat:enterprise_linux:5::client |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-libsRed Hat:enterprise_linux:5::client |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-workstationRed Hat:enterprise_linux:5::client |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5Red Hat:enterprise_linux:5::client_workstation |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-develRed Hat:enterprise_linux:5::client_workstation |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-serverRed Hat:enterprise_linux:5::client_workstation |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-server-ldapRed Hat:enterprise_linux:5::client_workstation |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5Red Hat:enterprise_linux:5::server |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-develRed Hat:enterprise_linux:5::server |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-libsRed Hat:enterprise_linux:5::server |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-serverRed Hat:enterprise_linux:5::server |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-server-ldapRed Hat:enterprise_linux:5::server |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-workstationRed Hat:enterprise_linux:5::server |
before 0:1.6.1-63.el5_7 | 0:1.6.1-63.el5_7 |
krb5-applRed Hat:enterprise_linux:6::client |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-clientsRed Hat:enterprise_linux:6::client |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-serversRed Hat:enterprise_linux:6::client |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-applRed Hat:enterprise_linux:6::computenode |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-clientsRed Hat:enterprise_linux:6::computenode |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-serversRed Hat:enterprise_linux:6::computenode |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-applRed Hat:enterprise_linux:6::server |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-clientsRed Hat:enterprise_linux:6::server |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-serversRed Hat:enterprise_linux:6::server |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-applRed Hat:enterprise_linux:6::workstation |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-clientsRed Hat:enterprise_linux:6::workstation |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5-appl-serversRed Hat:enterprise_linux:6::workstation |
before 0:1.0.1-7.el6_2 | 0:1.0.1-7.el6_2 |
krb5Red Hat:rhel_els:3::as |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-debuginfoRed Hat:rhel_els:3::as |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-develRed Hat:rhel_els:3::as |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-libsRed Hat:rhel_els:3::as |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-serverRed Hat:rhel_els:3::as |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-workstationRed Hat:rhel_els:3::as |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5Red Hat:rhel_els:3::es |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-debuginfoRed Hat:rhel_els:3::es |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-develRed Hat:rhel_els:3::es |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-libsRed Hat:rhel_els:3::es |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-serverRed Hat:rhel_els:3::es |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5-workstationRed Hat:rhel_els:3::es |
before 0:1.2.7-73 | 0:1.2.7-73 |
krb5Red Hat:rhel_mission_critical:5.3 |
before 0:1.6.1-31.el5_3.5 | 0:1.6.1-31.el5_3.5 |
krb5-debuginfoRed Hat:rhel_mission_critical:5.3 |
before 0:1.6.1-31.el5_3.5 | 0:1.6.1-31.el5_3.5 |
krb5-develRed Hat:rhel_mission_critical:5.3 |
before 0:1.6.1-31.el5_3.5 | 0:1.6.1-31.el5_3.5 |
krb5-libsRed Hat:rhel_mission_critical:5.3 |
before 0:1.6.1-31.el5_3.5 | 0:1.6.1-31.el5_3.5 |
krb5-serverRed Hat:rhel_mission_critical:5.3 |
before 0:1.6.1-31.el5_3.5 | 0:1.6.1-31.el5_3.5 |
krb5-workstationRed Hat:rhel_mission_critical:5.3 |
before 0:1.6.1-31.el5_3.5 | 0:1.6.1-31.el5_3.5 |
krb5Red Hat:rhel_eus:5.6 |
before 0:1.6.1-55.el5_6.3 | 0:1.6.1-55.el5_6.3 |
krb5-debuginfoRed Hat:rhel_eus:5.6 |
before 0:1.6.1-55.el5_6.3 | 0:1.6.1-55.el5_6.3 |
krb5-develRed Hat:rhel_eus:5.6 |
before 0:1.6.1-55.el5_6.3 | 0:1.6.1-55.el5_6.3 |
krb5-libsRed Hat:rhel_eus:5.6 |
before 0:1.6.1-55.el5_6.3 | 0:1.6.1-55.el5_6.3 |
krb5-serverRed Hat:rhel_eus:5.6 |
before 0:1.6.1-55.el5_6.3 | 0:1.6.1-55.el5_6.3 |
krb5-server-ldapRed Hat:rhel_eus:5.6 |
before 0:1.6.1-55.el5_6.3 | 0:1.6.1-55.el5_6.3 |
krb5-workstationRed Hat:rhel_eus:5.6 |
before 0:1.6.1-55.el5_6.3 | 0:1.6.1-55.el5_6.3 |
krb5-applRed Hat:rhel_eus:6.0 |
before 0:1.0.1-1.el6_0.1 | 0:1.0.1-1.el6_0.1 |
krb5-appl-clientsRed Hat:rhel_eus:6.0 |
before 0:1.0.1-1.el6_0.1 | 0:1.0.1-1.el6_0.1 |
krb5-appl-debuginfoRed Hat:rhel_eus:6.0 |
before 0:1.0.1-1.el6_0.1 | 0:1.0.1-1.el6_0.1 |
krb5-appl-serversRed Hat:rhel_eus:6.0 |
before 0:1.0.1-1.el6_0.1 | 0:1.0.1-1.el6_0.1 |
krb5-applRed Hat:rhel_eus:6.1 |
before 0:1.0.1-2.el6_1.3 | 0:1.0.1-2.el6_1.3 |
krb5-appl-clientsRed Hat:rhel_eus:6.1 |
before 0:1.0.1-2.el6_1.3 | 0:1.0.1-2.el6_1.3 |
krb5-appl-debuginfoRed Hat:rhel_eus:6.1 |
before 0:1.0.1-2.el6_1.3 | 0:1.0.1-2.el6_1.3 |
krb5-appl-serversRed Hat:rhel_eus:6.1 |
before 0:1.0.1-2.el6_1.3 | 0:1.0.1-2.el6_1.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | TelnetD encrypt_keyid - Function Pointer Overwrite | 2011-12-26 |
| Exploit-DB | Linux BSD-derived Telnet Service Encryption Key ID - Remote Buffer Overflow (Metasploit) | 2012-01-14 |
| Exploit-DB | FreeBSD - Telnet Service Encryption Key ID Buffer Overflow (Metasploit) | 2012-01-14 |
| Metasploit | Telnet Service Encryption Key ID Overflow Detection | |
| Metasploit | FreeBSD Telnet Service Encryption Key ID Buffer Overflow | 2011-12-23 |
| Metasploit | Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow | 2011-12-23 |
| PoC in GitHub | appsecrani/CVE-2011-4862 | 2020-02-06 |
| PoC in GitHub | hdbreaker/GO-CVE-2011-4862 | 2017-02-02 |
| PoC in GitHub | lol-fi/cve-2011-4862 | 2018-11-28 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
References
lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
secunia.com/advisories/47399
debian.org/security/2011/dsa-2375
redhat.com/support/errata/RHSA-2011-1854.html
archives.neohapsis.com/archives/bugtraq/2011-12/0172.html
Show 54 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html
lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html
security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc
mandriva.com/security/advisories?name=MDVSA-2011:195
osvdb.org/78020
securitytracker.com/id?1026463
git.savannah.gnu.org/cgit/inetutils.git/commit?id=665f1e73cdd9b38e2d2e11b8db9958a315935592
web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt
exploit-db.com/exploits/18280
exchange.xforce.ibmcloud.com/vulnerabilities/71970
nvd.nist.gov/vuln/detail/CVE-2011-4862
github.com/advisories/GHSA-x8cr-m6vm-pqh4
security-tracker.debian.org/tracker/CVE-2011-4862
access.redhat.com/errata/RHSA-2011:1851
bugzilla.redhat.com/show_bug.cgi?id=770325
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1851.json
cve.org/CVERecord?id=CVE-2011-4862
suse.com/security/cve/CVE-2011-1526