Bugtraq mailing list archives
RE: Solaris telnet vulnberability - how many on your network?
From: Michal Zalewski <lcamtuf () dione ids pl>
Date: Tue, 13 Feb 2007 20:36:20 +0100 (CET)
On Tue, 13 Feb 2007, Gadi Evron wrote:
I have to agree with a previous poster and suspect (only suspect) it could somehow be a backdoor rather than a bug.
You're attributing malice to what could be equally well (or better!) explained by incompetence or gross negligence. The latter two haunt large companies far more often, compared to sinister conspiracies. Yeah, a backdoor is a remote possibility. But it's also an arbitrary and needlessly complex one. Maybe it's a nefarious plot by our UFO-appointed shadow government, but chances are, it's not (they have better things to do today). Keep that in mind: when risking so much, of all the places to put a covert backdoor to use for years to come, pulling out a known flaw that will be spotted by many existing vulnerability scanners, and putting it in a service that is often disabled as obsolete and generally unreachable from the outside world, doesn't really make that much sense. Unless, of course, it's a sabotage attempt orchestrated by a joint team of IBM and SCO developers... now, that begins to make sense.. /mz
Current thread:
- Solaris telnet vulnberability - how many on your network? Gadi Evron (Feb 12)
- Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network? Vincent Archer (Feb 12)
- Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network? Huzeyfe Onal (Feb 12)
- Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network? armin walland (Feb 12)
- Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network? Huzeyfe Onal (Feb 12)
- RE: Solaris telnet vulnberability - how many on your network? Oliver Friedrichs (Feb 13)
- RE: Solaris telnet vulnberability - how many on your network? Gadi Evron (Feb 13)
- RE: Solaris telnet vulnberability - how many on your network? Oliver Friedrichs (Feb 13)
- RE: Solaris telnet vulnberability - how many on your network? Gadi Evron (Feb 13)
- RE: Solaris telnet vulnberability - how many on your network? Michal Zalewski (Feb 13)
- Re: Solaris telnet vulnberability - how many on your network? Casper . Dik (Feb 13)
- Re: Solaris telnet vulnberability - how many on your network? Gadi Evron (Feb 14)
- Re: Solaris telnet vulnberability - how many on your network? Damien Miller (Feb 14)
- Re: Solaris telnet vulnberability - how many on your network? Gadi Evron (Feb 15)
- RE: Solaris telnet vulnberability - how many on your network? Gadi Evron (Feb 13)
- Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network? Vincent Archer (Feb 12)
- Re[2]: Solaris telnet vulnberability - how many on your network? Thierry Zoller (Feb 14)
- RE: Re[2]: Solaris telnet vulnberability - how many on your network? Roger A. Grimes (Feb 14)
- RE: Re[2]: Solaris telnet vulnberability - how many on your network? Gadi Evron (Feb 15)
- Re: Re[2]: Solaris telnet vulnberability - how many on your network? Darren Reed (Feb 15)
- RE: Re[2]: Solaris telnet vulnberability - how many on your network? Evans, Thomas (Feb 15)
- Reflections on Trusting Trust [was: Re: Solaris telnet ...] Gadi Evron (Feb 16)