CVE-2009-0641: Freebsd

High severity, CVSS 9.3. EPSS: 9.3% chance of exploitation in the next 30 days.

sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client, as demonstrated by an LD_PRELOAD value that references a malicious library.

Affected products

• Freebsd Freebsd: version 7.0 only; version 7.0-release only; version 7.0_beta4 only; version 7.0_releng only; version 7.1 only

Published 2009-02-20. Last modified 2026-06-16.