bugtraq - Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability -

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <200702150349.l1F3nW4M009849@caligula.anu.edu.au>
Date: Thu, 15 Feb 2007 14:49:32 +1100 (Australia/ACT)
From: Darren Reed <avalon@...igula.anu.edu.au>
To: ge@...uxbox.org (Gadi Evron)
Cc: Michael.Wojcik@...rofocus.com (Michael Wojcik),
	bugtraq@...urityfocus.com
Subject: Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability -

In some mail from Gadi Evron, sie said:
> 
> On Tue, 13 Feb 2007, Michael Wojcik wrote:
> 
> > > From: Thierry Zoller [mailto:Thierry@...ler.lu] 
> > > Sent: Monday, 12 February, 2007 07:52
> > > 
> > > GE>     telnet -l "-froot" [hostname]
> > > 
> > > Should we really consider this a BUG ? With all due respect, this
> > > reads, smells and probably tastes like a backdoor
> > 
> > It's a bug.  I recall it being found and fixed in AIX many years ago.
> > Embarassing for Sun that it's still in Solaris, though.
> > 
> > It's actually caused by a "feature" of login; the bug is in programs
> > that exec login and pass "-froot" to it, and in preserving this feature
> > of login at all.
> > 
> > A quick Google search found Usenet postings about it from 1994; I'm sure
> > it was known well before then.
> 
> Hi Michael. Thank you for making that issue public (about login). Haven't
> seen it posted anywhere.
> 
> One note: although it could just as well be a bug, who says it was not a
> backdoor in the early 90's?
> 
> Also, I understand this does not work on older Solaris/SunOS systems
> (anyone can verify?) which adds to my personal interest in the
> possibility. I refuse to believe someone is that funny/sad.

See Casper Dik's email about when it was introduced...
He's not lieing...which is to say your email should not
have made it out to the list....

I just tried it locally with 5.7 and the result was:
$ telnet -l -froot localhost
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

Have you considered using SSH?

login:
telnet> Connection closed.

There are two methods to pass information through to telnet from
a remote connection as part of the telnet protocol:
- username
- terminal type

If either of these are passed through to the command line of /bin/login
then precautions need to be taken.

Darren