CVE-2009-0641

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-02-20 · updated 2026-06-16
Weakness: CWE-16

Description

sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client, as demonstrated by an LD_PRELOAD value that references a malicious library.

Affected products

FreeBSD: 7.0, 7.0-beta_4, 7.0-current, 7.0-release, 7.0_beta4, 7.0_releng (+2)

References

http://lists.grok.org.uk/pipermail/full-disclosure/2009-February/067954.html
http://security.freebsd.org/advisories/FreeBSD-SA-09:05.telnetd.asc
http://www.securityfocus.com/bid/33777
https://exchange.xforce.ibmcloud.com/vulnerabilities/48780
https://www.exploit-db.com/exploits/8055
http://lists.grok.org.uk/pipermail/full-disclosure/2009-February/067954.html
http://security.freebsd.org/advisories/FreeBSD-SA-09:05.telnetd.asc
http://www.securityfocus.com/bid/33777
https://exchange.xforce.ibmcloud.com/vulnerabilities/48780
https://www.exploit-db.com/exploits/8055

Get alerted when CVE-2009-0641 or the next vulnerability affects your stack