lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 13 Feb 2007 14:05:07 -0600 (CST) From: Gadi Evron <ge@...uxbox.org> To: Michal Zalewski <lcamtuf@...ne.ids.pl> Cc: Oliver Friedrichs <oliver_friedrichs@...antec.com>, bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk Subject: Re: Solaris telnet vulnberability - how many on your network? On Tue, 13 Feb 2007, Michal Zalewski wrote: > On Tue, 13 Feb 2007, Gadi Evron wrote: > > > I have to agree with a previous poster and suspect (only suspect) it > > could somehow be a backdoor rather than a bug. > > You're attributing malice to what could be equally well (or better!) > explained by incompetence or gross negligence. The latter two haunt large > companies far more often, compared to sinister conspiracies. > > Yeah, a backdoor is a remote possibility. But it's also an arbitrary and > needlessly complex one. Maybe it's a nefarious plot by our UFO-appointed > shadow government, but chances are, it's not (they have better things to > do today). > > Keep that in mind: when risking so much, of all the places to put a covert > backdoor to use for years to come, pulling out a known flaw that will be > spotted by many existing vulnerability scanners, and putting it in a > service that is often disabled as obsolete and generally unreachable from > the outside world, doesn't really make that much sense. Well, I just can't rule it out. It speaks for itself. Your voice of reason is naturally appreciated. I still believe it is a possibility, as what could be better? In 1994, this wasn't very far-off, nor was this noticable. Probable other explanations are abound, we will see if Sun sets us straight. > > Unless, of course, it's a sabotage attempt orchestrated by a joint team of > IBM and SCO developers... now, that begins to make sense.. Trucks and tubes I tell ya! > /mz > Gadi. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists