A Textbook Buffer Overflow: A Look at the FreeBSD telnetd Code

http://thexploit.com/secdev/a-textbook-buffer-overflow-a-look-at-the-freebsd-telnetd-code/

by thexploit • 15 years ago

64 23 15 years ago

thexploit.com

thirsteh• 15 years ago

https://twitter.com/#!/cperciva/status/150864360170983424

bdr• 15 years ago

Ok, but no one uses telnetd, right?

langsamer• 15 years ago

That is probably why it was overlooked

draven• 15 years ago

I've seen it being used by oldschool (obsolete) admins. When asked about security they argue the servers are in a DMZ, so it's safe, right?

ars2• 15 years ago

These days telnet comes wrapped in SSL, so it's totally possible to use it securely. I prefer public keys and almost never use telnet, but SSL telnet should be just as secure as password SSH.

yason2• 15 years ago

What's the point of SSL telnetd, because one could just use ssh? You still have to bring in some heavy crypto libraries (openssl) so 'telnets' isn't any more lightweight solution either. The only reason I can think of is some corporate policy that dictates the use of telnet, and for some reason SSL is approved but ssh, that hacking tool, isn't.

KonradKlause• 15 years ago

> Ok, but no one uses telnetd, right?

No. Telnet is heavily used in industrial environments.

makmanalp• 15 years ago

This makes me so scared.

harshreality• 15 years ago

There are also a fair number of soho [wireless] routers with telnet enabled by default.

I guess that's partly due to memory footprint, or assumed memory footprint (dropbear being fairly small), by the manufacturers, and partly due to windows not having a ssh client by default, whereas every major OS comes with a telnet client.

cperciva• 15 years ago

Debian popcon says they have 371 people using it regularly.

demetris• 15 years ago

For those who don’t know, “popcon” is short for Debian Popularity Contest, a project that collects stats about the usage of Debian packages from users who have installed the optional popcon package.

http://popcon.debian.org/

enjoy-your-stay• 15 years ago

I hereby propose a change to memcpy to include a maxbytes parameter and an optional assert() if len exceeds it.

Might turn up a few interesting things.

subleq• 15 years ago

memcpy's third argument is the maximum (additionally, the exact) number of bytes it will copy.

hackermom• 15 years ago

How many hands are needed to count the people still using telnet for anything remotely? I can see embedded use in isolated LANs, but...

ams6110• 15 years ago

Anyone know if the other BSDs share this code?

Nick_C• 15 years ago

According to comments on Colin's message, all BSDs as the bug has been there for years. OpenBSD doesn't have telnetd in its base distribution (and I currently don't have access to my OpenBSD server to check on the ports).

A Textbook Buffer Overflow: A Look at the FreeBSD telnetd Code

Related Stories