telnetd for netkit 0.17 and earlier, and possibly other versions, on Debian GNU/Linux allows remote attackers to cause a denial of service (free of an invalid pointer), a different vulnerability than CVE-2001-0554.

An update of the netkit package has been released.

A buffer overflow was discovered in the telnet client's handling of the LINEMODE suboptions. By sending a specially constructed reply containing a large number of SLC (Set Local Character) commands, a remote attacker (i. e. a malicious telnet server) could execute arbitrary commands with the privileges of the user running the telnet client. (CAN-2005-0469)

Michal Zalewski discovered a Denial of Service vulnerability in the telnet server (telnetd). A remote attacker could cause the telnetd process to free an invalid pointer, which caused the server process to crash, leading to a denial of service (inetd will disable the service if telnetd crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user). Please note that the telnet server is not officially supported by Ubuntu, it is in the 'universe' component.
(CAN-2004-0911).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Michal Zalewski discovered a bug in the netkit-telnet server (telnetd) whereby a remote attacker could cause the telnetd process to free an invalid pointer. This causes the telnet server process to crash, leading to a straightforward denial of service (inetd will disable the service if telnetd is crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user).

ID	Name	Product	Family	Type	Severity
334002	Photon OS 5.0: Netkit PHSA-2025-5.0-91-0666	Nessus	PhotonOS Local Security Checks	Local	critical
272313	Photon OS 4.0: Netkit PHSA-2025-4.0-0899	Nessus	PhotonOS Local Security Checks	Local	critical
272274	Photon OS 5.0: Netkit PHSA-2025-5.0-0666	Nessus	PhotonOS Local Security Checks	Local	critical
20487	Ubuntu 4.10 : netkit-telnet vulnerabilities (USN-101-1)	Nessus	Ubuntu Local Security Checks	Local	high
15667	Debian DSA-569-1 : netkit-telnet-ssl - invalid free(3)	Nessus	Debian Local Security Checks	Local	medium
15654	Debian DSA-556-2 : netkit-telnet - invalid free(3)	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2004-0911

high

Tenable Plugins

critical

critical

critical

high

medium

medium