← Vulnerability feed

Vulnerability record · CVE-2005-0488 · published 14 June 2005

CVE-2005-0488: Microsoft telnet client vulnerability

Microsoft · Telnet Client

Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.

5.0 CVSS 2.0 Medium EPSS 17% · top 3.0%
5.0CVSS 2.0 base score
17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
38References
16 Jun 2026Last modified by NVD

Description

Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive environment variables via the NEW-ENVIRON option with a SEND ENV_USERVAR command.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://idefense.com/application/poi/display?id=260&type=vulnerabilities Vendor Advisory
http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html
http://secunia.com/advisories/17135
http://secunia.com/advisories/21253
http://securitytracker.com/id?1014203
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101665-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101671-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57755-1 PatchVendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57761-1 PatchVendor Advisory
http://www.kb.cert.org/vuls/id/800829 PatchThird Party AdvisoryUS Government Resource
http://www.novell.com/linux/security/advisories/2005_16_sr.html
http://www.redhat.com/support/errata/RHSA-2005-504.html
http://www.redhat.com/support/errata/RHSA-2005-562.html
http://www.securityfocus.com/bid/13940
http://www.securityfocus.com/bid/19289
http://www.us-cert.gov/cas/techalerts/TA06-214A.html US Government Resource
http://www.vupen.com/english/advisories/2006/3101
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11373
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1139
http://idefense.com/application/poi/display?id=260&type=vulnerabilities Vendor Advisory
http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html
http://secunia.com/advisories/17135
http://secunia.com/advisories/21253
http://securitytracker.com/id?1014203
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101665-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101671-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57755-1 PatchVendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-57761-1 PatchVendor Advisory
http://www.kb.cert.org/vuls/id/800829 PatchThird Party AdvisoryUS Government Resource
http://www.novell.com/linux/security/advisories/2005_16_sr.html
http://www.redhat.com/support/errata/RHSA-2005-504.html
http://www.redhat.com/support/errata/RHSA-2005-562.html
http://www.securityfocus.com/bid/13940
http://www.securityfocus.com/bid/19289
http://www.us-cert.gov/cas/techalerts/TA06-214A.html US Government Resource
http://www.vupen.com/english/advisories/2006/3101
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11373
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1139

Track CVE-2005-0488 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2011-0285Mit kerberos 5 improper input validation vulnerabilityThe process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an …EPSS 21%10.0CVE-2010-4435Sunos vulnerabilityUnspecified vulnerability in Oracle Solaris 8, 9, and 10 allows remote attackers to affect confidentiality, integrity, and availability, related to C…EPSS 14%10.0CVE-2009-4212Mit kerberos vulnerabilityMultiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3,…EPSS 7.6%10.0CVE-2009-0846Mit kerberos 5 vulnerabilityThe asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 a…EPSS 8.9%10.0CVE-2008-4619Sunos vulnerabilityThe RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8 in progra…EPSS 12%10.0CVE-2008-2144Sunos vulnerabilityMultiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8, 9, and 10 allow remote attackers to cause a denial of service or exe…EPSS 16%10.0CVE-2008-0947Mit kerberos 5 memory buffer overflow vulnerabilityBuffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitr…EPSS 8.8%10.0CVE-2008-1369Sunos permissions and access controls vulnerabilityA certain incorrect Sun Solaris 10 image on SPARC Enterprise T5120 and T5220 servers has /etc/default/login and /etc/ssh/sshd_config files that confi…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2005-0488), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.