Bugtraq mailing list archives
Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability -
From: Darren Reed <avalon () caligula anu edu au>
Date: Thu, 15 Feb 2007 14:49:32 +1100 (Australia/ACT)
In some mail from Gadi Evron, sie said:
On Tue, 13 Feb 2007, Michael Wojcik wrote:From: Thierry Zoller [mailto:Thierry () Zoller lu] Sent: Monday, 12 February, 2007 07:52 GE> telnet -l "-froot" [hostname] Should we really consider this a BUG ? With all due respect, this reads, smells and probably tastes like a backdoorIt's a bug. I recall it being found and fixed in AIX many years ago. Embarassing for Sun that it's still in Solaris, though. It's actually caused by a "feature" of login; the bug is in programs that exec login and pass "-froot" to it, and in preserving this feature of login at all. A quick Google search found Usenet postings about it from 1994; I'm sure it was known well before then.Hi Michael. Thank you for making that issue public (about login). Haven't seen it posted anywhere. One note: although it could just as well be a bug, who says it was not a backdoor in the early 90's? Also, I understand this does not work on older Solaris/SunOS systems (anyone can verify?) which adds to my personal interest in the possibility. I refuse to believe someone is that funny/sad.
See Casper Dik's email about when it was introduced... He's not lieing...which is to say your email should not have made it out to the list.... I just tried it locally with 5.7 and the result was: $ telnet -l -froot localhost Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Have you considered using SSH? login: telnet> Connection closed. There are two methods to pass information through to telnet from a remote connection as part of the telnet protocol: - username - terminal type If either of these are passed through to the command line of /bin/login then precautions need to be taken. Darren
Current thread:
- Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? Thierry Zoller (Feb 12)
- RE: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? Michael Wojcik (Feb 13)
- Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? Casper . Dik (Feb 13)
- RE: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? Gadi Evron (Feb 14)
- Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - Darren Reed (Feb 15)
- RE: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? Michael Wojcik (Feb 13)