telnetd rulez: Cisco Ironport WSA Telnetd Remote Code Execution Vulnerability

Published: 2014-10-22
Last Updated: 2014-10-22 23:26:58 UTC
by Russ McRee (Version: 1)
3 comment(s)

We received the following vulnerability advisory for a remote code execution vuln identified and reported in Cisco's Ironport WSA Telnetd.

Vendor: Cisco
Product web page:
Affected version: Cisco Ironport WSA - AsyncOS 8.0.5 for Web build 075
Date: 22/05/2014
Credits: Glafkos Charalambous
CVE: CVE-2011-4862
CVSS Score: 7.6
Impact: Unauthenticated Remote Code Execution with elevated privileges
Description: The Cisco Ironport WSA virtual appliances are vulnerable to an old FreeBSD telnetd encryption Key ID buffer overflow which allows remote attackers to execute arbitrary code (CVE-2011-4862).
Cisco WSA Virtual appliances have the vulnerable telnetd daemon enabled by default.


Nice work by Glafkos but what you can't see is me shaking my head. *sigh*
I'll repeat the facepalm-inspiring statement again: "Cisco WSA Virtual appliances have the vulnerable telnetd daemon enabled by default."
Still, with the telnets? And on by default?
From the related FreeBSD advisory:
"The FreeBSD telnet daemon, telnetd(8), implements the server side of the
TELNET virtual terminal protocol.  It has been disabled by default in
FreeBSD since August 2001, and due to the lack of cryptographic security
in the TELNET protocol, it is strongly recommended that the SSH protocol
be used instead."

See if this sums up for you, courtesy of Glafkos:
Connected to
Escape character is '^]'.

[+] Exploiting, telnetd rulez!
[+] Target OS - FreeBSD 8.2 amd64
[*] Enjoy your shell

Disable telnetd!

3 comment(s)
Diary Archives