The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• canonical ubuntu linux5.10
• canonical ubuntu linux6.06
• canonical ubuntu linux6.10
• debian debian linux3.1
• debian debian linux4.0
• mit kerberos 5before 1.6.1

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2011-0285The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9
  46Plan
• CVE-2001-0247Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} se
  46Plan
• CVE-2002-1235The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and ea
  45Plan

Published before and after this one in the same product

• ← EarlierCVE-2006-6143Dec 31, 2006 · The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other produc
  39Monitor
• ← EarlierCVE-2006-6144Dec 31, 2006 · The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kad
  22Monitor
• Later →CVE-2007-0957Apr 5, 2007 · Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) a
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.