Re: Telnetd Vulnerability Report

[Steffen Nurpmeso <steffen () sdaoden eu>]

Solar Designer wrote in
 <20260225165449.GA23380 () openwall com>:
 |On Wed, Feb 25, 2026 at 07:46:07AM -0500, kf503bla () duck com wrote:
 |> telnet is extremely old and just because there is still widespread \
 |> use of telnet or the daemon, doesn't provide a valid reason to keep \
 |> using it. these trivial vulnerabilities keep popping up and if you \
 |> still insist of using telnet, you deserve getting pwned
 |
 |I mostly let these messages through so far (rejecting only one, which
 |had even less value), but as a moderator I declare end of sub-thread
 |now.  Further messages on "Who uses telnet anyway?" will be rejected by
 |default, unless they truly add something new.

It seems to me one reason to use telnet(1) arises from the fact
that there is no nc(1) around.  busybox has one, but it is not
feature rich enough.  And the one of LibreSSL, which is, as it
says, a swiss-army-knife, is very often not available at all.

So for example on AlpineLinux you have busybox/nc by default,
but need the "community" libressl-nc otherwise (and it is ~1.6MB,
not ~160KB); ditto ArchLinux, it does even seem to explicitly
exclude it from its "extra" package libressl.

On the BSDs it is better, they have the nc from way over a decade
ago, but refrain from updating (FreeBSD; dunno NetBSD: simply do
not update?) due to that being non-trivial.  DragonFly BSD is
different, as they have imported LibreSSL, and simply use the
nc(1) that ships with that (LibreSSL include that libtls that nc
now uses).

 |Messages on actual security issues/fixes in telnet are still desirable.

(Only to mention that i would not even offer telnet or rsh even
inside a VPN, as was heard.)

 |Alexander
 |
 |P.S. I first wrote the above in a confusing manner, not clarifying it's
 |only end of sub-thread started by kf503bla, not the entire thread.
 |Corrected now, and I'll only let this corrected message to oss-security.
 --End of <20260225165449.GA23380 () openwall com>

I do not know of "upgraded" ports of neither FreeBSD nor NetBSD
variants of nc(1) (usr.bin/nc), which include several iterations
and still make use of "normal OpenSSL" interface.  But sounds like
a valuable thing to do.

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)