bugtraq - RE: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 13 Feb 2007 05:56:47 -0800
From: "Michael Wojcik" <Michael.Wojcik@...rofocus.com>
To: <bugtraq@...urityfocus.com>
Subject: RE: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

> From: Thierry Zoller [mailto:Thierry@...ler.lu] 
> Sent: Monday, 12 February, 2007 07:52
> 
> GE>     telnet -l "-froot" [hostname]
> 
> Should we really consider this a BUG ? With all due respect, this
> reads, smells and probably tastes like a backdoor

It's a bug.  I recall it being found and fixed in AIX many years ago.
Embarassing for Sun that it's still in Solaris, though.

It's actually caused by a "feature" of login; the bug is in programs
that exec login and pass "-froot" to it, and in preserving this feature
of login at all.

A quick Google search found Usenet postings about it from 1994; I'm sure
it was known well before then.

-- 
Michael Wojcik
Principal Software Systems Developer, Micro Focus