Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

InetUtils 1.4.2 TFTP client may execute malicious code

CVE-2004-1485 · published 21 years ago
Summary

The TFTP client in InetUtils version 1.4.2 can be tricked by a malicious DNS server into running unwanted code when it receives an unusually large DNS reply. This could let an attacker take control of the affected system. Apply the vendor's update or disable the TFTP client until a fix is available, and avoid using untrusted DNS servers.

Original advisory text
Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by the gethostbyname function.
Buffer overflow in the TFTP client in InetUtils 1.4.2 allows remote malicious DNS servers to execute arbitrary code via a large DNS response that is handled by the gethostbyname function.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published31 Dec 2004
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2004-1485 · NVD
Track software like this
Free during beta