Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Worm Exploiting Solaris Telnetd Vulnerability

Posted by Zonk on Fri Mar 02, 2007 12:26 PM
from the beware-of-rotten-fruit dept.
Security Sun Microsystems Worms IT
MichaelSmith writes "Several news sites are reporting that a worm is starting to exploit the Solaris Telnet 0-day vulnerability. By adding simple text to the Telnet command, the system will skip asking for a username and password. If the systems are installed out of the box, they automatically come Telnet-enabled. 'The SANS Internet Storm Center, which monitors Internet threats, has noticed some increase in activity on the network port used by Solaris' telnet feature, according to an ISC blog posted on Tuesday. "One hopes that there aren't that many publicly reachable Solaris systems running telnet," ISC staffer Joel Esler wrote.'"
+ -
story

Related Stories

[+] Solaris Telnet 0-day vulnerability 342 comments
philos writes "According to SANS ISC, there's a vulnerability in Solaris 10 and 11 telnet that allows anyone to remotely connect as any account, including root, without authentication. Remote access can be gained with nothing more than a telnet client. More information and a Snort signature can be found at riosec.com. Worse, this is almost identical to a bug in AIX and Linux rlogin from way back in 1994."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Worm Exploiting Solaris Telnetd Vulnerability 25 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Yep. (Score:5, Insightful)

    by AltGrendel (175092) <ag-slashdotNO@SPAMexit0.us> on Friday March 02 2007, @12:31PM (#18207766) Homepage
    That's one of the first things any good admin turns off.

    Use SSH.

    ...oh, and don't forget to wear your raincoat.

    • Re:Yep. (Score:5, Insightful)

      by fm6 (162816) on Friday March 02 2007, @12:42PM (#18207892) Homepage Journal

      Yeah, that was my response when I first heard of this bug/exploit. But the real question is, should systems be shiped with telnet enabled? Obviously the answer is "no", but vendors seem to be slow to get this message.

      And note that this worm is enabled by a bug in Solaris's implementation of telnet, not by telnet itself. A similar bug in ssh would have had the same effect.

      • Re:Yep. (Score:4, Funny)

        by Venik (915777) on Friday March 02 2007, @01:08PM (#18208146)
        I think the real question is: should Solaris telnetd have such an immense security hole?
              • No, they do not!

                Stop repeating that!

                They don't use telnet, and that plaintext you see when sniffing their network is your natural ability to crack encryption.

                How many times do I have to tell you that you're special?!

                Now, back to the task I've given you. The NSA won't be lending me your brain again if you spend all my alloted time on /.

      • Re: (Score:3, Interesting)

        by ray-auch (454705)
        But the real question is, should systems be shiped with telnet enabled? Obviously the answer is "no", but vendors seem to be slow to get this message.

        This is Sun. Remember "+" in hosts.equiv ? They deliberately shipped with a known insecure default config in order to reduce support costs / complaints ("ease-of-use" was allegedly considered more important than security).

        • Re: (Score:3, Insightful)

          by fm6 (162816)
          Putting ease of use ahead of security is hardly unique to Sun. Actually, this kind of thing isn't even an ease of use issue. Somebody gets a customer complaint, they see a fix, and they implement it without thinking through the security implications. Happens every day — usually several times.

    • Re:Yep. (Score:4, Insightful)

      by iamacat (583406) on Friday March 02 2007, @01:24PM (#18208380)
      ssh is actually more complex than telnet and more likely to have exploitable bugs - there were a couple featured on slashdot in fact. ssh is for protection of the user, not the host system. It can make intrusion recovery more difficult, as you will not be able to see what the attacker is doing using network monitoring tools. Sun just got sloppy/unlucky with this one by unnecessarily mucking with login. Don't they teach in school to not add command line options/environment variables to a setuid program?
          • - The Solaris telnet authenticates against their login PAM modules, which only uses the first 8 chars of the password for authentication. SSH bypasses /bin/login and passwords can be as long as you want. This is more longtime Solaris silliness that has not been fixed in Solaris 10.

            At least they do come with a binch of stuff disabled by default, and with a fairly recent version of SSH.

            I *DO* have numerous Solaris hosts happily floating in the effuent of an unfirewalled Internet connection, and they are probe

    • Correction (Score:3, Interesting)

      by Megane (129182)

      Correction: that's one of the first things any good distro never turns on.

      Linux and BSD had it for a long time before Solaris had it in the standard install. And you can't even enable telnetd on OS X since about 10.2 or so, unless you know how to edit the right config files in /etc.

  • Oh no (Score:4, Funny)

    by wumpus188 (657540) on Friday March 02 2007, @12:34PM (#18207796)
    These 4 users running telnet on solaris are gonna be pissed...

  • Mine is! (Score:3, Insightful)

    by Doctor Memory (6336) on Friday March 02 2007, @12:37PM (#18207846) Homepage
    But it's only reachable via ports 80 and 443. And I installed patch #120069-02 a couple of weeks ago. In fact, I already installed the -03 version of that patch. If you keep up with your security patches, it's really not a problem. Of course, this is easy for me to say, I have one workstation; I'm sure that for sites with dozens (or hundreds) of servers, it's more problematic. I also STR that patch 120069 used to require a reboot after installation, which makes it a bit more of a hassle to install (I usually save those for Fridays, when I can install them and then walk away while the box reboots).

  • I might have missed something.... (Score:4, Informative)

    by 8127972 (73495) on Friday March 02 2007, @12:38PM (#18207848)
    .... but wasn't this just fixed?

    http://blogs.sun.com/tpenta/entry/the_in_telnetd_v ulnerability_exploit [sun.com]

  • It's been a long day... (Score:5, Insightful)

    by Odiumjunkie (926074) on Friday March 02 2007, @12:40PM (#18207868)
    So, just to be clear, this story, posted on March 2nd, is reporting on a worm which has started exploiting a zero day vulnerability that was covered by slashdot on February 12th?

    Isn't twenty days long enough to disable a remotely exploitable and totally unnecessery, unsafe service that no admin in his right mind should have enabled on a box connected to the net anyway?

    • Re:It's been a long day... (Score:4, Funny)

      by Cheapy (809643) on Friday March 02 2007, @12:43PM (#18207906)
      Sysadmins have been search this entire time to find a Solaris box to fix.

      They are still searching.

    • Re: (Score:3, Interesting)

      by dknj (441802)
      Judging by your UID, i will assume you are new here and new to IT in general. In The Real World(tm), patches are not applied as soon as they are released. You must test them, most managers are clueless to OS level patches and require the same testing process that, say, application testing goes through. I have seen patches take a week to be approved and put into production and I have worked with companies that have a 30 day delayed patch release schedule.

      With that said, no one should be running any insecu

  • Should have happened... (Score:5, Insightful)

    by alexhs (877055) on Friday March 02 2007, @12:47PM (#18207944) Homepage Journal
    What about this argument that OSs other than Microsoft ones don't get malware developped for them because they don't have significant marketshare, again ?

  • telwhat? (Score:3, Funny)

    by glwtta (532858) on Friday March 02 2007, @12:52PM (#18207980) Homepage
    Tell who?

    What year is it?

  • Other Telnet vulnerabilities (Score:3, Insightful)

    by Flying pig (925874) on Friday March 02 2007, @12:52PM (#18207988)
    Amazing but true - there are printers on some networks which are accessible over the public Internet and which have their telnet ports exposed. I'm obviously not spelling out the implications here, but some people need the proverbial rocket up the backside.

  • Telnet for transparency? (Score:4, Interesting)

    by Anonymous Coward on Friday March 02 2007, @12:53PM (#18207990)
    A while ago I found a strange comment here about why telnet was still used, even by security-knowledgeable IT department. The comment was saying this:

    Large financial institutions in Europe use telnet, as use of encryption is restricted on their trusted networks, for reasons of transparency to the stock regulating authorities. (Googling for this phrase should get you the /. comment)

    If this is true (and not the post of a random troll), can anyone shed some light on this? For it seems very strange... There are many other way to provide transparency to the financial authorities without having to compromise your network no!?

  • A new box won't have this problem... (Score:3, Insightful)

    by kenh (9056) on Friday March 02 2007, @12:58PM (#18208034) Homepage Journal
    This is not present in the Update 3 of Solaris, released 11/06 - that prompts the user to enable "network services" if they like, but warns that will expose the system to problems. One of those problems is the famously insecure telnetd service. If you say "No" telnetd is not installed/activated - and "No" is the default.

    Existing boxes need to fix this, but a patch has been out for a while - are we dealing with the "short bus" hackers that it took this long to actually exploit? Why, oh why, doesn't Solaris warrant better hackers? ;^)

    • It's such a joke that every one claims to be more secure then the next guy. But really they mean if you turn everything off and patch your system every day.

      Which is the default, these days.

      That's what a 0 day exploit means. You have to patch every day or you could be at risk.

      No, a 0 day exploit means even if you patch every day, you're still at risk. But you know what? You're at risk every day simply by being alive. You could be hit by a meteor the next second! Oh noes!

      Grow up and stop fearmongering. Th

    • So besides the old argument of "I have legacy systems / applications which rely on telnet and other outdated modes of communication", why would people use telnet? Laziness? Ignorance? What else am I missing here?

      People who use telnet on a large scale that I know of include:

      • European financial companies who are not allowed to use encryption while trading stock for regulatory reasons (on a private network).
      • South and Central American ISPs who provide shell accounts as part of internet access and who have to support the lowest common denominator.
      • Major network operators in Asia and China who run telnet on their control networks.
      • New hardware appliances that are configured once from telnet or console and for whom SSH

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.