CVE-2022-39028 : telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivativ

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

Published 2022-08-30 05:15:08

Updated 2023-09-27 20:10:25

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2022-39028

Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
MIT » Kerberos 5
Versions up to, including, (<=) 1.0.3
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
Matching versions
GNU » Inetutils
Versions up to, including, (<=) 2.3
cpe:2.3:a:gnu:inetutils:*:*:*:*:*:*:*:*
Matching versions
Netkit-telnet Project » Netkit-telnet
Versions up to, including, (<=) 0.17
cpe:2.3:a:netkit-telnet_project:netkit-telnet:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2022-39028

Top countries where our scanners detected CVE-2022-39028

Top open port discovered on systems with this issue 21

IPs affected by CVE-2022-39028 217,947

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2022-39028!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2022-39028

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-39028

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-39028

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-39028

https://lists.debian.org/debian-lts-announce/2022/11/msg00033.html

[SECURITY] [DLA 3205-1] inetutils security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=113da8021710d871c7dd72d2a4d5615d42d64289

debian/pkgs/inetutils.git - Debian inetutils packaging
Mailing List;Patch;Vendor Advisory
https://pierrekim.github.io/blog/2022-08-24-2-byte-dos-freebsd-netbsd-telnetd-netkit-telnetd-inetutils-telnetd-kerberos-telnetd.html

2-byte DoS in freebsd-telnetd / netbsd-telnetd / netkit-telnetd / inetutils-telnetd / telnetd in Kerberos Version 5 Applications - Binary Golf Grand Prix 3 - CVE-2022-39028 - IT Security Research by P
Exploit;Patch;Third Party Advisory
https://lists.gnu.org/archive/html/bug-inetutils/2022-08/msg00002.html

[BUG][PATCH] Someone described a remote DoS Vulnerability in telnetd (de
Mailing List;Vendor Advisory