Re: CVE-2011-4862 is not BSD-specific

[Huzaifa Sidhpurwala <huzaifas () redhat com>]

On 12/25/2011 10:44 PM, Florian Weimer wrote:
> This is just a heads-up: CVE-2011-4862, a pre-authentication buffer
> overflow in telnetd recently fixed by FreeBSD is not BSD-specific.  It
> seems to have been added at MIT when the BSD telnetd was Kerberized,
> and it ended up in the Heimdal recryptofication of Kerberos (from
> where FreeBSD got it) and later in GNU inetutils.  I have reproduced a
> pre-authentication segfault with both versions (as shipped by Debian).
>
> The telnetd from netkit does not appear to be affected.

The patch seems to be applicable though, probably you need to do 
something else to make it segfault?



--
Huzaifa Sidhpurwala / Red Hat Security Response Team