CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-40303
https://notcve.org/view.php?id=CVE-2023-40303
GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop privileges before letting an ordinary user control the activities of the process. • http://www.openwall.com/lists/oss-security/2023/12/30/4 https://ftp.gnu.org/gnu/inetutils https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6 https://lists.debian.org/debian-lts-announce/2023/10/msg00013.html https://lists.gnu.org/archive/html/bug-inetutils/2023-07/msg00000.html • CWE-252: Unchecked Return Value •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2022-39028
https://notcve.org/view.php?id=CVE-2022-39028
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. telnetd en GNU Inetutils versiones hasta 2.3, MIT krb5-appl versiones hasta 1.0.3, y trabajos derivados presenta una desreferencia de puntero NULL por medio de 0xff 0xf7 o 0xff 0xf8. • https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289 https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html https://lists.gnu.org/archive/html/bug-inetutils/2022-08/msg00002.html https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-40491
https://notcve.org/view.php?id=CVE-2021-40491
The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl. El cliente ftp en GNU Inetutils versiones anteriores a 2.2, no comprueba las direcciones devueltas por las respuestas PASV/LSPV para asegurarse de que coinciden con la dirección del servidor. Esto es similar a CVE-2020-8284 para curl • https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476 https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html https://lists.gnu.org/archive/html/bug-inetutils/2021-06/msg00002.html • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 10.0EPSS: 96%CPEs: 21EXPL: 6CVE-2011-4862 – FreeBSD - Telnet Service Encryption Key ID Buffer Overflow
https://notcve.org/view.php?id=CVE-2011-4862
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011. Desbordamiento de búfer basado en pila en libtelnet/encrypt.c en telnetd en FreeBSD v7.3 hasta v9.0, MIT Kerberos Version v5 Applications (también conocido como krb5-appl) v1.0.2 y anteriores, y Heimdal v1.5.1 y anteriores, permite a atacantes remotos ejecutar código de su elección a través de una clave de cifrado larga, como fue explotado en Diciembre 2011. Detect telnet services vulnerable to the encrypt option Key ID overflow (BSD-derived telnetd). • https://www.exploit-db.com/exploits/18369 https://www.exploit-db.com/exploits/18368 https://www.exploit-db.com/exploits/18280 https://github.com/hdbreaker/GO-CVE-2011-4862 https://github.com/kpawar2410/CVE-2011-4862 http://archives.neohapsis.com/archives/bugtraq/2011-12/0172.html http://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=665f1e73cdd9b38e2d2e11b8db9958a315935592 http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071627.html http://lists.fedoraproject.org/p • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2004-1485
https://notcve.org/view.php?id=CVE-2004-1485
Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by the gethostbyname function. • http://marc.info/?l=bugtraq&m=109882085912915&w=2 http://www.securityfocus.com/bid/11527 https://exchange.xforce.ibmcloud.com/vulnerabilities/17878 •