Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: in.telnetsnoopd [slackware]
From: 8lgm () CND NET (8LGM Security Advisories)
Date: Thu, 20 Feb 1997 17:51:31 -0500


You can download the "patch" for in.telnetsnoopd from sunsite.
you will need the old source for telnetsnoopd too..

On Thu, 20 Feb 1997, JS/Illz wrote:

I'm not sure if this has been discussed or not, but in.telnetsnoopd is
exploitable on my Linux Slackware 2.0.27 system.
As most know, the standard in.telnetd was patched against the 'libroot'
exploit that made use of the "LD_PRELOAD" command in telnet. The patch (if
I remember correctly) blocked environment variables longer than xxxx from
being passed as an argument as "libroot" was. Unfortunately, it seems
someone overlooked telnetsnoop, as this is still exploitable.
Fix:
Edit your inetd.conf to reenable standard telnet, rather than snoop telnet.
Snooping is bad manners anyways =).


Jeff Sorensen <jeff () ngbert org>
Programming/Graphic Arts
Admin: psionik.net/synapse




  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]