Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

2007-02-15 Thread Joep Vesseur
Gadi, [...] One note: although it could just as well be a bug, who says it was not a backdoor in the early 90's? Also, I understand this does not work on older Solaris/SunOS systems (anyone can verify?) I can. It is not present in anything before Solaris 10. which adds to my personal

Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

2007-02-15 Thread Gadi Evron
On Thu, 15 Feb 2007, Joep Vesseur wrote: Gadi, [...] One note: although it could just as well be a bug, who says it was not a backdoor in the early 90's? Also, I understand this does not work on older Solaris/SunOS systems (anyone can verify?) I can. It is not present in

RE: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

2007-02-14 Thread Gadi Evron
On Tue, 13 Feb 2007, Michael Wojcik wrote: From: Thierry Zoller [mailto:[EMAIL PROTECTED] Sent: Monday, 12 February, 2007 07:52 GE telnet -l -froot [hostname] Should we really consider this a BUG ? With all due respect, this reads, smells and probably tastes like a backdoor

RE: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

2007-02-13 Thread Michael Wojcik
From: Thierry Zoller [mailto:[EMAIL PROTECTED] Sent: Monday, 12 February, 2007 07:52 GE telnet -l -froot [hostname] Should we really consider this a BUG ? With all due respect, this reads, smells and probably tastes like a backdoor It's a bug. I recall it being found and fixed in

Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

2007-02-13 Thread Casper . Dik
It's a bug. I recall it being found and fixed in AIX many years ago. Embarassing for Sun that it's still in Solaris, though. It's not still in Solaris; it's the first time it occurred in Solaris; it is stupid it did but it's a typical programming error: passing unchecked arguments to a program

Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

2007-02-12 Thread Thierry Zoller
Dear List, GE telnet -l -froot [hostname] GE but this bug isnt -froot, its -fanythingbutroot =P Should we really consider this a BUG ? With all due respect, this reads, smells and probably tastes like a backdoor, and obvious one granted but still, to my believe this raises the question are