Buffer overflow in the slc_add_reply function in various BSD-based Telnet clients, when handling LINEMODE suboptions, allows remote attackers to execute arbitrary code via a reply with a large number of Set Local Character (SLC) commands.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Telnet | Ncsa | * | * |
Red Hat Enterprise Linux 3 | RedHat | telnet-1:0.17-26.EL3.2 | * |
Red Hat Enterprise Linux 3 | RedHat | krb5-0:1.2.7-42 | * |
Red Hat Enterprise Linux 4 | RedHat | telnet-1:0.17-31.EL4.2 | * |
Red Hat Enterprise Linux 4 | RedHat | krb5-0:1.3.4-12 | * |
Heimdal | Ubuntu | dapper | * |
Heimdal | Ubuntu | devel | * |
Heimdal | Ubuntu | edgy | * |
Heimdal | Ubuntu | feisty | * |
Krb4 | Ubuntu | dapper | * |
Krb4 | Ubuntu | edgy | * |
Krb5 | Ubuntu | dapper | * |
Krb5 | Ubuntu | devel | * |
Krb5 | Ubuntu | edgy | * |
Krb5 | Ubuntu | feisty | * |
Netkit-telnet | Ubuntu | dapper | * |
Netkit-telnet | Ubuntu | devel | * |
Netkit-telnet | Ubuntu | edgy | * |
Netkit-telnet | Ubuntu | feisty | * |
Netkit-telnet-ssl | Ubuntu | dapper | * |
Netkit-telnet-ssl | Ubuntu | devel | * |
Netkit-telnet-ssl | Ubuntu | edgy | * |
Netkit-telnet-ssl | Ubuntu | feisty | * |