Bugtraq mailing list archives
in.telnetsnoopd [slackware]
From: jeff () NGBERT ORG (JS/Illz)
Date: Thu, 20 Feb 1997 13:48:17 -0600
I'm not sure if this has been discussed or not, but in.telnetsnoopd is exploitable on my Linux Slackware 2.0.27 system. As most know, the standard in.telnetd was patched against the 'libroot' exploit that made use of the "LD_PRELOAD" command in telnet. The patch (if I remember correctly) blocked environment variables longer than xxxx from being passed as an argument as "libroot" was. Unfortunately, it seems someone overlooked telnetsnoop, as this is still exploitable. Fix: Edit your inetd.conf to reenable standard telnet, rather than snoop telnet. Snooping is bad manners anyways =). Jeff Sorensen <jeff () ngbert org> Programming/Graphic Arts Admin: psionik.net/synapse
Current thread:
- in.telnetsnoopd [slackware] JS/Illz (Feb 20)
- Re: in.telnetsnoopd [slackware] 8LGM Security Advisories (Feb 20)
- Re: in.telnetsnoopd [slackware] Roscinante (Feb 20)