# CVE-1999-1098: BSD Telnet client session decryption via Kerberos 4 sniffing

Source: https://junglewise.ai/threats/cve-1999-1098-bsd-telnet-client-session-decryption-via-kerberos-4-sniffing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1995-03-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-1098 · Severity: medium · CVSS 5 · Published 1995-03-03

A vulnerability exists in the BSD Telnet client when using Kerberos 4 authentication and session encryption. This flaw allows an attacker who can monitor network traffic to bypass the intended encryption and read the contents of the communication. This could lead to the exposure of sensitive information transmitted during the remote login session.

Technologies: [Bsd](https://junglewise.ai/threats/technologies/bsd). Vendors: [Bsd](https://junglewise.ai/threats/vendors/bsd).

## Quick answers

**Is CVE-1999-1098 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-1098 being exploited in the wild.

**How severe is CVE-1999-1098?** Medium severity, with a CVSS score of 5, published 3 March 1995.

**Which products and versions are affected?** Berkeley Software Distribution Telnet Client All versions using Kerberos 4 and encryption prior to March 1995.

**Is there a fix for CVE-1999-1098?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-1098 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-1999-1098?** Check whether you run Berkeley Software Distribution Telnet Client or Bsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The BSD Telnet client contains a flaw in its implementation of session encryption when paired with Kerberos 4 authentication. Due to an error in how encryption keys are handled or negotiated, the session encryption can be compromised by an attacker with the ability to capture network packets (sniffing). This allows the attacker to decrypt the supposedly secure communication stream. The vulnerability is exploited over the network without requiring prior authentication, though it requires the attacker to be in a position to intercept traffic. Patches were released by various vendors following the CERT advisory in 1995.

## Affected products

- BSD Telnet client All versions using Kerberos 4 and encryption prior to March 1995

## Timeline

- 1995-03-03: advisory: Initial NVD publication and CERT advisory CA-1995-03 released

## References

- [http://www.cert.org/advisories/CA-1995-03.html](http://www.cert.org/advisories/CA-1995-03.html)
- [http://www.ciac.org/ciac/bulletins/f-12.shtml](http://www.ciac.org/ciac/bulletins/f-12.shtml)
- [http://www.iss.net/security_center/static/516.php](http://www.iss.net/security_center/static/516.php)
- [http://www.osvdb.org/4881](http://www.osvdb.org/4881)

## Related threats

- [Sun Solaris and BSD UNIX domain socket permission bypass](https://junglewise.ai/threats/cve-1999-1402-sun-solaris-and-bsd-unix-domain-socket-permission-bypass)