bugtraq - Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <45D39B5A.3000509@Sun.COM>
Date: Thu, 15 Feb 2007 00:29:30 +0100
From: Joep Vesseur <Joep.Vesseur@....COM>
To: Gadi Evron <ge@...uxbox.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how
 many on yournetwork?

Gadi,

> [...]
> One note: although it could just as well be a bug, who says it was not a
> backdoor in the early 90's?
 >
> Also, I understand this does not work on older Solaris/SunOS systems
> (anyone can verify?) 

I can. It is not present in anything before Solaris 10.

> which adds to my personal interest in the
> possibility. I refuse to believe someone is that funny/sad.

Not sure what you mean here... You don't believe this is a (very
unfortunate) accident?

 From where I stand (pretty close to the fire) this is pretty much
what it looks like (an extended multi-file, multi-entrance-point
change with unforseen and unnoticed interdependencies).

Joep