Heap-based buffer overflow in the env_opt_add function in telnet.c for various BSD-based Telnet clients allows remote attackers to execute arbitrary code via responses that contain a large number of characters that require escaping, which consumers more memory than allocated.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Telnet | Ncsa | c (including) | c (including) |
| Red Hat Enterprise Linux 3 | RedHat | telnet-1:0.17-26.EL3.2 | * |
| Red Hat Enterprise Linux 3 | RedHat | krb5-0:1.2.7-42 | * |
| Red Hat Enterprise Linux 4 | RedHat | telnet-1:0.17-31.EL4.2 | * |
| Red Hat Enterprise Linux 4 | RedHat | krb5-0:1.3.4-12 | * |
| Krb4 | Ubuntu | dapper | * |
| Krb4 | Ubuntu | edgy | * |
| Krb5 | Ubuntu | dapper | * |
| Krb5 | Ubuntu | devel | * |
| Krb5 | Ubuntu | edgy | * |
| Krb5 | Ubuntu | feisty | * |