DSA-2373-1 inetutils -- buffer overflow

Debian Security Advisory

DSA-2373-1 inetutils -- buffer overflow

Date Reported:

25 Dec 2011

Affected Packages:

inetutils

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2011-4862.

More information:

It was discovered that the Kerberos support for telnetd contains a pre-authentication buffer overflow, which may enable remote attackers who can connect to TELNET to execute arbitrary code with root privileges.

For the oldstable distribution (lenny), this problem has been fixed in version 2:1.5.dfsg.1-9+lenny1.

For the stable distribution (squeeze), this problem has been fixed in version 2:1.6-3.1+squeeze1.

For the testing distribution (wheezy) and the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your inetutils packages.