SUSE update for telnet
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2022-39028 |
| CWE-ID | CWE-476 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software |
SUSE OpenStack Cloud Crowbar Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE OpenStack Cloud Operating systems & Components / Operating system telnet-server-debuginfo Operating systems & Components / Operating system package or component telnet-server Operating systems & Components / Operating system package or component telnet-debugsource Operating systems & Components / Operating system package or component telnet-debuginfo Operating systems & Components / Operating system package or component telnet Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) NULL pointer dereference
EUVDB-ID: #VU67777
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-39028
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in telnetd daemon. A remote attacker can trigger NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8 and crash telnetd.
Update the affected package telnet to the latest version.
Vulnerable software versionsSUSE OpenStack Cloud Crowbar: 9
SUSE Linux Enterprise Server for SAP: 12-SP4
SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5
SUSE OpenStack Cloud: 9
telnet-server-debuginfo: before 1.2-167.10.1
telnet-server: before 1.2-167.10.1
telnet-debugsource: before 1.2-167.10.1
telnet-debuginfo: before 1.2-167.10.1
telnet: before 1.2-167.10.1
CPE2.3- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:9:*:*:*:*:*:*:*
- cpe:2.3:a:suse:telnet-server-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:telnet-server:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:telnet-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:telnet-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:telnet:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20223735-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
