CVE-2005-0488 Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND E...
MediumCVSS 5.0
EPSS 17.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft telnet client | = 5.1.2600.2180 | No fix listed |
| mit kerberos 5 | = 1.3.4 | No fix listed |
| sunos | = 5.9 | No fix listed |
| debian/krb5(Debian:12) | < 1.8.3+dfsg-4 | 1.8.3+dfsg-4 |
| debian/krb5(Debian:13) | < 1.8.3+dfsg-4 | 1.8.3+dfsg-4 |
| debian/krb5(Debian:14) | < 1.8.3+dfsg-4 | 1.8.3+dfsg-4 |
References
- 20050614 Multiple Vendor Telnet Client Information Disclosure Vulnerability third-party-advisory vendor-advisory
- APPLE-SA-2006-08-01 vendor-advisory
- 17135 third-party-advisory
- 21253 third-party-advisory
- 1014203 vdb-entry
- 101665 vendor-advisory
- 101671 vendor-advisory
- 57755 patch vendor-advisory
- 57761 patch vendor-advisory
- VU#800829 patch third-party-advisory us-government-resource
- SUSE-SR:2005:016 vendor-advisory
- RHSA-2005:504 vendor-advisory
- RHSA-2005:562 vendor-advisory
- 13940 vdb-entry
- 19289 vdb-entry
- TA06-214A third-party-advisory us-government-resource
- ADV-2006-3101 vdb-entry
- oval:org.mitre.oval:def:11373 signature vdb-entry
- oval:org.mitre.oval:def:1139 signature vdb-entry
- Debian Security Tracker CVE-2005-0488 vendor-advisory