Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Worm Exploiting Solaris Telnetd Vulnerability

Posted by Zonk on Fri Mar 02, 2007 11:26 AM
from the beware-of-rotten-fruit dept.
Security Sun Microsystems Worms IT
MichaelSmith writes "Several news sites are reporting that a worm is starting to exploit the Solaris Telnet 0-day vulnerability. By adding simple text to the Telnet command, the system will skip asking for a username and password. If the systems are installed out of the box, they automatically come Telnet-enabled. 'The SANS Internet Storm Center, which monitors Internet threats, has noticed some increase in activity on the network port used by Solaris' telnet feature, according to an ISC blog posted on Tuesday. "One hopes that there aren't that many publicly reachable Solaris systems running telnet," ISC staffer Joel Esler wrote.'"
+ -
story

Related Stories

[+] Solaris Telnet 0-day vulnerability 342 comments
philos writes "According to SANS ISC, there's a vulnerability in Solaris 10 and 11 telnet that allows anyone to remotely connect as any account, including root, without authentication. Remote access can be gained with nothing more than a telnet client. More information and a Snort signature can be found at riosec.com. Worse, this is almost identical to a bug in AIX and Linux rlogin from way back in 1994."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Worm Exploiting Solaris Telnetd Vulnerability 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Yep. (Score:5, Insightful)

    by AltGrendel (175092) <ag-slashdot.exit0@us> on Friday March 02 2007, @11:31AM (#18207766) Homepage
    That's one of the first things any good admin turns off.

    Use SSH.

    ...oh, and don't forget to wear your raincoat.

    • Re:Yep. (Score:5, Insightful)

      by fm6 (162816) on Friday March 02 2007, @11:42AM (#18207892) Homepage Journal

      Yeah, that was my response when I first heard of this bug/exploit. But the real question is, should systems be shiped with telnet enabled? Obviously the answer is "no", but vendors seem to be slow to get this message.

      And note that this worm is enabled by a bug in Solaris's implementation of telnet, not by telnet itself. A similar bug in ssh would have had the same effect.

      • Re:Yep. (Score:4, Funny)

        by Venik (915777) on Friday March 02 2007, @12:08PM (#18208146)
        I think the real question is: should Solaris telnetd have such an immense security hole?
          • -->I think the real question is: should Solaris telnetd have such an immense security hole?

            what an idiotic question

            I think the question was rhetorical.

            My question is: Who the hell still uses telnet? I don't even use telnet on my LAN.

              • No, they do not!

                Stop repeating that!

                They don't use telnet, and that plaintext you see when sniffing their network is your natural ability to crack encryption.

                How many times do I have to tell you that you're special?!

                Now, back to the task I've given you. The NSA won't be lending me your brain again if you spend all my alloted time on /.

              • Re: (Score:3, Insightful)

                by Venik (915777)
                There is nothing inherently wrong with telnet. It has functional limitations, just as any other method of communication. Telnet can be safely used, when its limitations are accounted in the overall environment. Look at it this way. A company that makes locks accidentally produced a model that can be opened by any key. Oops. You are saying: Hey, everybody knows that locks can be picked, so why are you still using them? Do you see a difference between a design limitation and a production defect?

      • Re: (Score:3, Interesting)

        by ray-auch (454705)
        But the real question is, should systems be shiped with telnet enabled? Obviously the answer is "no", but vendors seem to be slow to get this message.

        This is Sun. Remember "+" in hosts.equiv ? They deliberately shipped with a known insecure default config in order to reduce support costs / complaints ("ease-of-use" was allegedly considered more important than security).

        • Re: (Score:3, Insightful)

          by fm6 (162816)
          Putting ease of use ahead of security is hardly unique to Sun. Actually, this kind of thing isn't even an ease of use issue. Somebody gets a customer complaint, they see a fix, and they implement it without thinking through the security implications. Happens every day — usually several times.

      • Yeah, that was my response when I first heard of this bug/exploit. But the real question is, should systems be shiped with telnet enabled? Obviously the answer is "no", but vendors seem to be slow to get this message.

        Serious questions: 1. Who ships with telnet enabled? Certainly not Apple or any of the Linux distros I've used. and 2. Who uses Unix systems with the default build installed by Sun? Do they even _come_ with an OS anymore?
      • "Yeah, that was my response when I first heard of this bug/exploit."

        Eh? My response was, who cares, no one uses it, but I'll check the top leevl comments to see if there was anything interesting or insightfull. I guess not ;)

      • Re: (Score:3, Insightful)

        by pclminion (145572)

        Yeah, that was my response when I first heard of this bug/exploit. But the real question is, should systems be shiped with telnet enabled? Obviously the answer is "no", but vendors seem to be slow to get this message.

        Why the hell not? Installation of Solaris is not exactly an "end user" type of operations. More likely it would be performed by an IT professional. Having telnet enabled initially makes it easy to setup the system from another location without worrying about making ssh or anything else work

    • A good Windows admin has a router, firewall, anti-virus, automatic updates and a 3rd party browser. If that's not a good argument against the thousands of Windows zombies out there then it's not a good argument for you either.

    • Re:Yep. (Score:4, Insightful)

      by iamacat (583406) on Friday March 02 2007, @12:24PM (#18208380)
      ssh is actually more complex than telnet and more likely to have exploitable bugs - there were a couple featured on slashdot in fact. ssh is for protection of the user, not the host system. It can make intrusion recovery more difficult, as you will not be able to see what the attacker is doing using network monitoring tools. Sun just got sloppy/unlucky with this one by unnecessarily mucking with login. Don't they teach in school to not add command line options/environment variables to a setuid program?

      • Exactly. All these comments to the effect of "telnetd should be off by default" are missing the point. Yes, telnetd should be off by default, but that's just so that dumb users don't get used to typing in their passwords over a cleartext connection.

        It makes me wonder about how much original thought there is on Slashdot, versus how many comments are just clueless people using technical terms in a syntactically-correct fashion without really understanding what they're saying.

        If I went back into the Slas

          • - The Solaris telnet authenticates against their login PAM modules, which only uses the first 8 chars of the password for authentication. SSH bypasses /bin/login and passwords can be as long as you want. This is more longtime Solaris silliness that has not been fixed in Solaris 10.

            At least they do come with a binch of stuff disabled by default, and with a fairly recent version of SSH.

            I *DO* have numerous Solaris hosts happily floating in the effuent of an unfirewalled Internet connection, and they are probe

    • Correction (Score:3, Interesting)

      by Megane (129182)

      Correction: that's one of the first things any good distro never turns on.

      Linux and BSD had it for a long time before Solaris had it in the standard install. And you can't even enable telnetd on OS X since about 10.2 or so, unless you know how to edit the right config files in /etc.

      • Yes, they did. In PHBthink, it's cheaper to bring in a consultant at any cost when a problem occurs instead of spending the money on maintenance. The results of the money spent on maintenance are invisible, whereas consultants address known, specific problems. I think the management-by-russian-roulette philosophy is all the rage in MBA schools now.

  • Oh no (Score:4, Funny)

    by wumpus188 (657540) on Friday March 02 2007, @11:34AM (#18207796)
    These 4 users running telnet on solaris are gonna be pissed...

  • Mine is! (Score:3, Insightful)

    by Doctor Memory (6336) on Friday March 02 2007, @11:37AM (#18207846) Homepage
    But it's only reachable via ports 80 and 443. And I installed patch #120069-02 a couple of weeks ago. In fact, I already installed the -03 version of that patch. If you keep up with your security patches, it's really not a problem. Of course, this is easy for me to say, I have one workstation; I'm sure that for sites with dozens (or hundreds) of servers, it's more problematic. I also STR that patch 120069 used to require a reboot after installation, which makes it a bit more of a hassle to install (I usually save those for Fridays, when I can install them and then walk away while the box reboots).
    • > I'm sure that for sites with dozens (or hundreds) of servers, it's more problematic

      Although in those cases I'd hope that they'd have everything nicely automated so that pushing out updates is just a matter running some utility that executes the update on all the machines. As Zed Shaw [zedshaw.com] says, "if you're ssh'ing in to your servers more than once a week, you haven't automated things enough."

      Of course there will be exceptions - custom installations and whatnot - but hopefully a change like this could just b

      • As Zed Shaw [zedshaw.com] says, "if you're ssh'ing in to your servers more than once a week, you haven't automated things enough."

        Dude, many data centers have thousands of servers. Sun itself sells a blade system [sun.com] that puts 20 servers in a single rack. In that kind of environment, if you ever ssh into your systems, you haven't automated things enough!

    • > If you keep up with your security patches, it's really not a problem.

      I dare say that most sysadmins who keep up with patches don't have telnetd running.

  • I might have missed something.... (Score:4, Informative)

    by 8127972 (73495) on Friday March 02 2007, @11:38AM (#18207848)
    .... but wasn't this just fixed?

    http://blogs.sun.com/tpenta/entry/the_in_telnetd_v ulnerability_exploit [sun.com]

  • It's been a long day... (Score:5, Insightful)

    by Odiumjunkie (926074) on Friday March 02 2007, @11:40AM (#18207868)
    So, just to be clear, this story, posted on March 2nd, is reporting on a worm which has started exploiting a zero day vulnerability that was covered by slashdot on February 12th?

    Isn't twenty days long enough to disable a remotely exploitable and totally unnecessery, unsafe service that no admin in his right mind should have enabled on a box connected to the net anyway?

    • Re:It's been a long day... (Score:4, Funny)

      by Cheapy (809643) on Friday March 02 2007, @11:43AM (#18207906)
      Sysadmins have been search this entire time to find a Solaris box to fix.

      They are still searching.
    • You must be new here.

    • Isn't twenty days long enough to disable a remotely exploitable and totally unnecessery, unsafe service that no admin in his right mind should have enabled on a box connected to the net anyway?

      Yes, but some people are a little slow... others are just overworked... and then there are the stupid ones...

      Honestly, does anybody have a use for telnet anymore? It really shouldn't be enabled by default anyway. I guess if your system isn't connected to the Internet you have no fears, but who would do that?

      • I work for a major bank that leaves telnet on all over the place, in spite of the 1997 company policy of replacing it with SSH as soon as possible. Sensible configuration and maintenance are impossible when business people micromanage the technology side. You'd think that putting a gun to their head would be enough to make people do it, but you'd be wrong. They're one step ahead of us all. Business people cannot be harmed by a bullet to the brain. They're already brain dead.

    • Re: (Score:3, Interesting)

      by dknj (441802)
      Judging by your UID, i will assume you are new here and new to IT in general. In The Real World(tm), patches are not applied as soon as they are released. You must test them, most managers are clueless to OS level patches and require the same testing process that, say, application testing goes through. I have seen patches take a week to be approved and put into production and I have worked with companies that have a 30 day delayed patch release schedule.

      With that said, no one should be running any insecu

  • Should have happened... (Score:5, Insightful)

    by alexhs (877055) on Friday March 02 2007, @11:47AM (#18207944) Homepage Journal
    What about this argument that OSs other than Microsoft ones don't get malware developped for them because they don't have significant marketshare, again ?
    • It's not just marketshare. Being easily exploited and high profile also need to fit the bill too. Do we ever hear about exploits for QNX, BeOS, OS/2, Minix, etc? At least we don't hear about them on slashdot.

  • telwhat? (Score:3, Funny)

    by glwtta (532858) on Friday March 02 2007, @11:52AM (#18207980) Homepage
    Tell who?

    What year is it?

  • Other Telnet vulnerabilities (Score:3, Insightful)

    by Flying pig (925874) on Friday March 02 2007, @11:52AM (#18207988)
    Amazing but true - there are printers on some networks which are accessible over the public Internet and which have their telnet ports exposed. I'm obviously not spelling out the implications here, but some people need the proverbial rocket up the backside.

  • Telnet for transparency? (Score:4, Interesting)

    by Anonymous Coward on Friday March 02 2007, @11:53AM (#18207990)
    A while ago I found a strange comment here about why telnet was still used, even by security-knowledgeable IT department. The comment was saying this:

    Large financial institutions in Europe use telnet, as use of encryption is restricted on their trusted networks, for reasons of transparency to the stock regulating authorities. (Googling for this phrase should get you the /. comment)

    If this is true (and not the post of a random troll), can anyone shed some light on this? For it seems very strange... There are many other way to provide transparency to the financial authorities without having to compromise your network no!?

  • A new box won't have this problem... (Score:3, Insightful)

    by kenh (9056) on Friday March 02 2007, @11:58AM (#18208034) Homepage Journal
    This is not present in the Update 3 of Solaris, released 11/06 - that prompts the user to enable "network services" if they like, but warns that will expose the system to problems. One of those problems is the famously insecure telnetd service. If you say "No" telnetd is not installed/activated - and "No" is the default.

    Existing boxes need to fix this, but a patch has been out for a while - are we dealing with the "short bus" hackers that it took this long to actually exploit? Why, oh why, doesn't Solaris warrant better hackers? ;^)
  • ...on writing the worlds most unsuccessful worm.

    isn't even coming close to their trend on activity-by-ports page
  • And is it going to take another 20 years to close all the holes in telnet?
  • At the university where I work, there were a number of people running Solaris boxes who weren't even aware that telnet was running. It's not that they weren't aware of the secure advantage of using SSH. But they just weren't paying close attention to what ports they had open.

    So if you or someone you know runs Solaris, but uses SSH, make sure that telnet is 100% disabled for sure!
  • I don't even run inetd!

  • Given the age of the vulnerability, it's probably just the Morris worm [wikipedia.org] still kicking about.
  • The last time I used telnet was probably somewhere in the late 90's. Since then I've been using ssh, like most people. Besides being secure, ssh puts a lot of power and flexibility at my fingertips: port-forwarding for tunnelling, passwordless connectivity, secure file transfers just to name a few. So it could be that it's been so long that I don't see the point of using telnet anymore, let alone willingly leave it enabled on my systems.

    So besides the old argument of "I have legacy systems / applications wh

    • So besides the old argument of "I have legacy systems / applications which rely on telnet and other outdated modes of communication", why would people use telnet? Laziness? Ignorance? What else am I missing here?

      People who use telnet on a large scale that I know of include:

      • European financial companies who are not allowed to use encryption while trading stock for regulatory reasons (on a private network).
      • South and Central American ISPs who provide shell accounts as part of internet access and who have to support the lowest common denominator.
      • Major network operators in Asia and China who run telnet on their control networks.
      • New hardware appliances that are configured once from telnet or console and for whom SSH

    • Re: (Score:2, Informative)

      by ebvwfbw (864834)
      What about replacing telnetd with openbsd's?

      It won't help because the vulnerability is in login (that telnetd calls) and not with telenetd. Since this is almost a month old and everyone should know by now, here it is -

      telnet -l "-froot" [hostname]

    • It's such a joke that every one claims to be more secure then the next guy. But really they mean if you turn everything off and patch your system every day.

      Which is the default, these days.

      That's what a 0 day exploit means. You have to patch every day or you could be at risk.

      No, a 0 day exploit means even if you patch every day, you're still at risk. But you know what? You're at risk every day simply by being alive. You could be hit by a meteor the next second! Oh noes!

      Grow up and stop fearmongering. Th

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.