Merry Christmas from the FreeBSD Security Team

#1

Post by cperciva » Fri, Dec 23, 2011, 5:02 PM UTC

Merry Christmas from the FreeBSD Security Team
lists.freebsd.org

Re: Merry Christmas from the FreeBSD Security Team

#2

Post by jws » Fri, Dec 23, 2011, 5:46 PM UTC

A buffer overflow in telnetd that allows arbitrary execution as root from remote TCP connections. It doesn't get much worse than that.

At least telnetd is disabled by default so most installs won't be vulnerable.

Re: Merry Christmas from the FreeBSD Security Team

#3

Post by corbet » Fri, Dec 23, 2011, 5:51 PM UTC

I'm amazed that telnet still lives after all these years.

I wonder if anybody has audited telnetd implementations on other systems for the same problem?

Re: Merry Christmas from the FreeBSD Security Team

#4

Post by SomeOtherGuy » Fri, Dec 23, 2011, 6:04 PM UTC

corbet wrote: post #3

I'm amazed that telnet still lives after all these years. I wonder if anybody has audited telnetd implementations on other systems for the same problem?

I'm pretty sure openbsd is fine, since they removed telnetd from the OS years ago. The big question is, why do other systems still have a telnetd?

Re: Merry Christmas from the FreeBSD Security Team

#5

Post by simcop2387 » Fri, Dec 23, 2011, 6:05 PM UTC

corbet wrote: post #3

I'm amazed that telnet still lives after all these years. I wonder if anybody has audited telnetd implementations on other systems for the same problem?

Only thing I know of that it gets used for in my work is to talk to certain routers that don't support ssh version 2 since the software I work with doesn't support ssh version 1 anymore.

Re: Merry Christmas from the FreeBSD Security Team

#6

Post by stock_toaster » Fri, Dec 23, 2011, 7:03 PM UTC

simcop2387 wrote: post #5

corbet wrote: post #3

I'm amazed that telnet still lives after all these years. I wonder if anybody has audited telnetd implementations on other systems for the same problem?

Only thing I know of that it gets used for in my work is to talk to certain routers that don't support ssh version 2 since the software I work with doesn't support ssh version 1 anymore.

Yeah, lots of switches use telnet too. Most of those are (hopefully!) on a backhaul private vlan though.

Re: Merry Christmas from the FreeBSD Security Team

#7

Post by blumentopf » Fri, Dec 23, 2011, 7:25 PM UTC

Gee, that BIND vulnerability was made public mid-November and they're integrating that into FreeBSD on Dec 23 ?!

Re: Merry Christmas from the FreeBSD Security Team

#8

Post by joshAg » Fri, Dec 23, 2011, 7:28 PM UTC

SomeOtherGuy wrote: post #4

corbet wrote: post #3

I'm amazed that telnet still lives after all these years. I wonder if anybody has audited telnetd implementations on other systems for the same problem?

I'm pretty sure openbsd is fine, since they removed telnetd from the OS years ago. The big question is, why do other systems still have a telnetd?

same reason there are still Cobol jobs. Users, for various reasons (ranging from dubious to valid), refuse to update to a more modern solution.

Re: Merry Christmas from the FreeBSD Security Team

#9

Post by bazerka » Fri, Dec 23, 2011, 7:43 PM UTC

blumentopf wrote: post #7

Gee, that BIND vulnerability was made public mid-November and they're integrating that into FreeBSD on Dec 23 ?!

Not quite...

Corrected:

  2011-11-16 23:41:13 UTC (ports tree)

  2011-11-17 01:10:16 UTC (RELENG_7, 7.4-STABLE)
  2011-11-17 00:36:10 UTC (RELENG_8, 8.2-STABLE)

  2011-12-01 21:13:41 UTC (RELENG_9, 9.0-STABLE)
  2011-12-01 21:17:59 UTC (RELENG_9_0, 9.0-RC3)

  2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
  2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
  2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
  2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)

Re: Merry Christmas from the FreeBSD Security Team

#10

Post by ajross » Fri, Dec 23, 2011, 7:46 PM UTC

joshAg wrote: post #8

SomeOtherGuy wrote: post #4

Earlier quoted context omitted.

I'm pretty sure openbsd is fine, since they removed telnetd from the OS years ago. The big question is, why do other systems still have a telnetd?

same reason there are still Cobol jobs. Users, for various reasons (ranging from dubious to valid), refuse to update to a more modern solution.

Telnet is still quite common in the embedded world. Existing tool boxes have implementations, busybox has a telnet client and daemon built-in, etc... It's easy. If the box never goes beyond a development rack it's safe. And if it's what you've been doing for 15 years there's not a lot of value in change.