Detailed Description
telnet daemon telnetd achieve TELNET virtual terminal protocol server.
Buffer overrun vulnerability exists in the realization of telnetd, remote attacker could exploit this vulnerability control server.
TELNET protocol data stream with an encryption mechanism, when the encryption key provided by the TELNET protocol, its length is not verified, flaw-related code before being copied into the fixed size buffer function located "encrypt_keyid ()" (crypto / heimdal / appl /telnet/libtelnet/encrypt.c and contrib / telnet / libtelnet / encrypt.c)
Solution
Manufacturers patch:
FreeBSD
-------
Current vendors have released an updated patch to fix the security issue, please go to the manufacturer's home page to download:
http://www.freebsd.org/security/index.html
REDHAT
Name: RHSA-2011:1854
Hyperlink:http://rhn.redhat.com/errata/RHSA-2011-1854.html
External Source: REDHAT
Name: RHSA-2011:1853
Hyperlink:http://rhn.redhat.com/errata/RHSA-2011-1853.html
External Source: REDHAT
Name: RHSA-2011:1852
Hyperlink:http://rhn.redhat.com/errata/RHSA-2011-1852.html
External Source: REDHAT
Name: RHSA-2011:1851
Hyperlink:http://rhn.redhat.com/errata/RHSA-2011-1851.html
DEBIAN
External Source: DEBIAN
Name: DSA-2375
Hyperlink:http://www.debian.org/security/2011/dsa-2375
External Source: DEBIAN
Name: DSA-2373
Hyperlink:http://www.debian.org/security/2011/dsa-2373
External Source: DEBIAN
Name: DSA-2372
Hyperlink:http://www.debian.org/security/2011/dsa-2372
SUSE:
External Source: SUSE
Name: SUSE-SU-2012:0056
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00015.html
External Source: SUSE
Name: openSUSE-SU-2012:0051
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html
External Source: SUSE
Name: SUSE-SU-2012:0050
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html
External Source: SUSE
Name: SUSE-SU-2012:0042
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
External Source: SUSE
Name: SUSE-SU-2012:0024
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00007.html
External Source: SUSE
Name: openSUSE-SU-2012:0019
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html
External Source: SUSE
Name: SUSE-SU-2012:0018
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html
External Source: SUSE
Name: SUSE-SU-2012:0010
Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
FEDORA:
External Source: FEDORA
Name: FEDORA-2011-17493
Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071640.html
External Source: FEDORA
Name: FEDORA-2011-17492
Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html