CVE-2011-4862Gnu Inetutils Classic Buffer Overflow

NVD

Vulnerability Summary

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

Severity Level

UNKNOWN

Published Date

Dec 25, 2011

Last Modified

Apr 29, 2026

PoC

Available(Metasploit)

Exploitation Status

ACTIVE

EPSS Score (30-Day)

92.59%Probability

Root Weakness (CWE)

CWE-120: Classic Buffer Overflow ↗

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected & Patched Versions

Affected Versions

Gnu Inetutils < 1.9
Heimdal Project Heimdal <= 1.5.1
Mit Krb5-appl <= 1.0.2
Freebsd Freebsd >= 7.3 and <= 9.0
Fedoraproject Fedora
Debian Debian Linux
Opensuse Opensuse
Suse Linux Enterprise Desktop
Suse Linux Enterprise Server
Suse Linux Enterprise Software Development Kit

Patched Versions

Gnu Inetutils 1.9

What to do

Treat as urgent. Attackers are exploiting this flaw.

Check whether you run Gnu Inetutils and which version.
Update to a patched version listed above, then confirm the new version.
Review logs and exposed services for signs of earlier compromise.

Timeline

Dec 25, 2011Published
Apr 29, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Gnu Inetutils CVEsYou are reading CVE-2011-4862. Get an email when KEV listings, exploits or new CVEs match your stack.

Set up CVE alerts

More Gnu Inetutils CVEs

CVE-2026-32772LOW · Mar 16, 2026
CVE-2026-32746CRITICAL · Mar 13, 2026
CVE-2026-28372HIGH · Feb 27, 2026
CVE-2026-24061CRITICAL · Jan 21, 2026
CVE-2022-39028UNKNOWN · Aug 30, 2022
CVE-2021-40491UNKNOWN · Sep 3, 2021

External References

Referencehttp://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html
Patchhttp://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592
Advisoryhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html
Advisoryhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html
Referencehttp://osvdb.org/78020
Advisoryhttp://secunia.com/advisories/46239
Advisoryhttp://secunia.com/advisories/47341
Advisoryhttp://secunia.com/advisories/47348
Advisoryhttp://secunia.com/advisories/47357
Advisoryhttp://secunia.com/advisories/47359
Advisoryhttp://secunia.com/advisories/47373
Advisoryhttp://secunia.com/advisories/47374
Advisoryhttp://secunia.com/advisories/47397
Advisoryhttp://secunia.com/advisories/47399
Advisoryhttp://secunia.com/advisories/47441
Vendor Advisoryhttp://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc
Patchhttp://security.freebsd.org/patches/SA-11:08/telnetd.patch
Patchhttp://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt
Vendor Advisoryhttp://www.debian.org/security/2011/dsa-2372
Vendor Advisoryhttp://www.debian.org/security/2011/dsa-2373
Vendor Advisoryhttp://www.debian.org/security/2011/dsa-2375
Exploithttp://www.exploit-db.com/exploits/18280/
Vendor Advisoryhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:195
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1851.html
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1852.html
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1853.html
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1854.html
Advisoryhttp://www.securitytracker.com/id?1026460
Advisoryhttp://www.securitytracker.com/id?1026463
Advisoryhttps://exchange.xforce.ibmcloud.com/vulnerabilities/71970
Referencehttp://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html
Patchhttp://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592
Advisoryhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html
Advisoryhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006117.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006118.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006119.html
Vendor Advisoryhttp://lists.freebsd.org/pipermail/freebsd-security/2011-December/006120.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html
Advisoryhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html
Referencehttp://osvdb.org/78020
Advisoryhttp://secunia.com/advisories/46239
Advisoryhttp://secunia.com/advisories/47341
Advisoryhttp://secunia.com/advisories/47348
Advisoryhttp://secunia.com/advisories/47357
Advisoryhttp://secunia.com/advisories/47359
Advisoryhttp://secunia.com/advisories/47373
Advisoryhttp://secunia.com/advisories/47374
Advisoryhttp://secunia.com/advisories/47397
Advisoryhttp://secunia.com/advisories/47399
Advisoryhttp://secunia.com/advisories/47441
Vendor Advisoryhttp://security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc
Patchhttp://security.freebsd.org/patches/SA-11:08/telnetd.patch
Patchhttp://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-008.txt
Vendor Advisoryhttp://www.debian.org/security/2011/dsa-2372
Vendor Advisoryhttp://www.debian.org/security/2011/dsa-2373
Vendor Advisoryhttp://www.debian.org/security/2011/dsa-2375
Exploithttp://www.exploit-db.com/exploits/18280/
Vendor Advisoryhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:195
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1851.html
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1852.html
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1853.html
Advisoryhttp://www.redhat.com/support/errata/RHSA-2011-1854.html
Advisoryhttp://www.securitytracker.com/id?1026460
Advisoryhttp://www.securitytracker.com/id?1026463
Advisoryhttps://exchange.xforce.ibmcloud.com/vulnerabilities/71970

Data last checked: Nov 14, 2026 23:13 UTC