CVE-2022-39028

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:netkit-telnet_project:netkit-telnet:*:*:*:*:*:*:*:*

History

27 Sep 2023, 20:10

Type Values Removed Values Added
CPE cpe:2.3:a:netkit-telnet_project:netkit-telnet:*:*:*:*:*:*:*:*
First Time Netkit-telnet Project netkit-telnet
Netkit-telnet Project

29 Nov 2022, 17:35

Type Values Removed Values Added
First Time Debian
Debian debian Linux
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html - Mailing List, Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

25 Nov 2022, 21:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html -

06 Sep 2022, 17:34

Type Values Removed Values Added
First Time Gnu inetutils
Gnu
Mit
Mit kerberos 5
CWE CWE-476
CPE cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
References (MISC) https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289 - (MISC) https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289 - Mailing List, Patch, Vendor Advisory
References (MISC) https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html - (MISC) https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html - Exploit, Patch, Third Party Advisory
References (MISC) https://lists.gnu.org/archive/html/bug-inetutils/2022-08/msg00002.html - (MISC) https://lists.gnu.org/archive/html/bug-inetutils/2022-08/msg00002.html - Mailing List, Vendor Advisory

30 Aug 2022, 05:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-08-30 05:15

Updated : 2023-12-10 14:35


NVD link : CVE-2022-39028

Mitre link : CVE-2022-39028

CVE.ORG link : CVE-2022-39028


JSON object : View

Products Affected

netkit-telnet_project

  • netkit-telnet

debian

  • debian_linux

gnu

  • inetutils

mit

  • kerberos_5
CWE
CWE-476

NULL Pointer Dereference