Solaris Telnet 0-day vulnerability 342
philos writes "According to SANS ISC, there's a vulnerability in Solaris 10 and 11 telnet that allows anyone to remotely connect as any account, including root, without authentication. Remote access can be gained with nothing more than a telnet client. More information and a Snort signature can be found at riosec.com. Worse, this is almost identical to a bug in AIX and Linux rlogin from way back in 1994."
Why is this a big deal? (Score:5, Insightful)
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
but ONLY on trusted lans, of course.
I find it quicker than ssh logins. of course its quicker, it has no encryption to do. and the initial seeding (at connect time) also takes a LONG time on some boxes (ssh to a cisco box; come back after lunch and you'll get your login prompt).
telnet over a wan is dumb. telnet over a 10' piece of wire is NOT dumb.
telnet has its place.
Re: (Score:3, Insightful)
Opening/enabling telnet is a mistake. Even if you're using it safely, which, in my mind, is across a hub that isn't connected to anything else but the two computers you're talking to you've still got that port open and vulnerable. Using it on a LAN is just begging someone with a packet sniffer t
Re:Why is this a big deal? (Score:4, Informative)
Re: (Score:3, Informative)
Re: (Score:2)
It may take _that_ long on a sparc box, but stick some nice amd opterons in there and you'll never even notice. Seriously though, even on a private lan is stupid. SSH has replaced telnet for a reason. If that was one of my servers, I'd tell the guy to GFY.
Re: (Score:3, Interesting)
Thats nice and all, but I believe the GP was referring to systems w/ embedded processors, where thast not an option, and I also think he was whining about the initial key gereation (that first time you set it up process), which can take a bit of time on embedded processors. As an example, the Pix 515 has a lowly Pentium 166 at its core, the heavy math of calculating big primes can take a while.
Re:Why is this a big deal? (Score:5, Insightful)
Can you get the OS vendor to jump and have a man there within 30 minutes to fix it if a supported OS function doesn't work? Yes. Can you get the OS vendor to jump and have a man there within 30 minutes if OpenSSH doesn't work? No. Sometimes it's as simple as that, unfortunately.
That said, don't think that I believe telnet is a good substitute for ssh, but often, and especially in a turtled environment (hard on the outside, soft on the inside) where five nines are more important than internal security, it may still be a better choice, at least until all the OS vendors provide fully supported (and compatible!) versions of SSH.
Re: (Score:3, Informative)
admittedly, they'd old 'test' junker boxes that I use for netmgt testing. I had to write some expect style scripts to login to them, throw a command, get the buffer output, parse it and disconnect. for each kind of 'thing' I wanted to remotely retrieve.
it took over 20 secs, on SOME cisco boxes, to get a ssh prompt back.
quite unacceptable.
then I used telnet and it was almost instant.
again, if you secure your lan (my 10' piece of PRIVATE WIRE) there is NOTHING wrong with teln
Re:Why is this a big deal? (Score:5, Insightful)
The OP is right, he knows his risks and has deemed it acceptable. You and others, having no idea of the risk, deem it unacceptable and are the ignorant ones.
Re: (Score:3, Insightful)
Hmmmm. Decisions, decisions, decisions.
Re: (Score:3, Insightful)
2) service telnetd stop;service sshd start
3) Hitting "Y" one time is too much bother for you?
4) Non-issue on all but the slowest hardware.
5) I don't see how that is a benefit...
Re: (Score:3, Insightful)
Re:Why is this a big deal? (Score:5, Insightful)
Most likely, the reverse DNS is misconfigured. This is the number one reason for ssh-login delays. Maybe, the nameservers initially put into the router's configuration are no longer reachable due to subsequent "hardening". Or, maybe, they went away and were replaced long ago — without anybody telling the routers. Nothing else on a router uses DNS usually, so this problem affects only ssh-daemon and gets blamed on it...
The daemon could, of course, be a little bit smarter and not try to do a reverse DNS, when there are no hostname-based authorization rules in the first place... But that's a minor bug compared to reverse DNS being dysfunctional.
Re: (Score:2)
Re: (Score:2)
Sending password in clear text is disturbing, even on a "trusted" network. I mean, it's so easy to do a tcpdump...
With rsh you don't even need to (instead edit
Re: (Score:2)
To the grandparent, the overhead of SSH is tiny. The time spent entering your password over telnet is going to be greater than the time spent doing a public key handshake on anything faster than a 486SX. If you are lazy, share private keys on all of yo
Re: (Score:2)
To the grandparent, the overhead of SSH is tiny. The time spent entering your password over telnet is going to be greater than the time spent doing a public key handshake on anything faster than a 486SX. If you are lazy, share private keys on all of your trusted machines.
Exagerated. My home server is a Pentium 166 MX. I can exchange less than 10Mbps with ssh, while I can transfer a little more than 30Mbps with rsh unencrypted content. That's why I'm using rsh.
About IP spoofing, remember I was comparing rsh to telnet, not to ssh. Kerberos requires authentification so IP spoofing won't be enough, and IP spoofing can be detected checking MAC address. MAC address can also be spoofed, but it becomes more difficult to do that without being detected than a tcpdump.
Re: (Score:2)
You should encrypt on the LAN anyway unless there is a really good reason not to - many hacks/information thefts/destruction of data etc. is caused by company insiders. There is no such thing as a trusted network (except perhaps the network in your house). The expectation that a company LAN is secure has got m
Re: (Score:2)
I just enter my passphrase after I log in (using ssh-add), and then ssh-agent manages t
Re: (Score:3, Informative)
Who the hell even THINKS about enabling telnet on any box these days?
Sun, apparently, since it's enabled by default.
Re: (Score:2)
Re:Why is this a big deal? (Score:5, Informative)
Re: (Score:3, Informative)
Re:Why is this a big deal? (Score:4, Informative)
If you're on Solaris 8 (SunOS 5.8 or Solaris 2.5.8) or 9 (SunOS 5.9, or Solaris 2.5.9), you appear to be safe.
This is relevant because large companies seldom jump to the newer versions until they have to - for production systems, as long as the older versions are supported and working, that's more important than gambling on existing software still working if upgrading the OS. So there's an awful lot of systems with Solaris 8 and 9 out there, but luckily they appear not to be affected.
Re: (Score:3, Informative)
Only in Solaris 10 11/06 was it disabled, and only if SBD was selected.
This sheds a wholly new light on 'Secure By Default':
Disabling telnet ! Yahoo ! - if SBD is set.
Re:Why is this a big deal? (Score:5, Funny)
telnet 23/tcp imadumbass hackmenow rootrus rotflmao
Re:Why is this a big deal? (Score:5, Funny)
Having said that, today is a good day to find out if that head of IT you never liked anyway has telnet enabled on one of his Solaris machines
Re: (Score:2)
Re: (Score:2)
Who the hell even THINKS about enabling telnet on any box these days?
And how many remember to run "pkgrm SUNWtnetd" to be sure.
Who uses telnet these days? (Score:3, Funny)
Re:Why is this a big deal? (Score:5, Interesting)
1) Fermi National Accelerator Laboratory.
That'll account for a couple thousand computers. It's left as an exercise for the reader to find other sites.
Are they just crazy? I know that almost every single box at FNAL has the telnet daemon running, and is behind no firewall. Why aren't they hacked-to-death? Kerberos.
FNAL has a policy that every service beyond central IT's web pages is protected by Kerberos. The Kerberos-enabled version of telnet is as secure as one can get; I've been told by their sysadmins that it is more secure than SSH because it is simpler and the network and authz/authn stacks are separated. So, historically, Kerberos-enabled telnet has had less bugs than SSH.
Just because YOU don't run telnet (or don't know how to run it securely) doesn't mean that there aren't thousands of boxes out there that are secured by it.
If there are actually any Sun boxes at FNAL (they were one of the original big adopters of Linux), you can bet they'll probably be turned off today...
Re: (Score:3, Informative)
Re: (Score:2, Informative)
That is all internal of course. Off-site access
Re:Why is this a big deal? (Score:4, Insightful)
If it were me I'd just log everything in every session (which is easy), and make the users use SSH. That way you can audit everything they do, every command they type, but still have a level of security. You have to remember that any user can sniff telnet traffic on the network, so forcing everyone to use telnet because you don't trust them means the ones who are untrustworthy have a better chance of stealing something useful from a coworker.
Even better would be to hire trustworthy people and treat them as such in the absence of evidence to the contrary.
Re:Why is this a big deal? (Score:4, Informative)
You're right... No more secure websites for you, since HTTPS is just HTTP over an SSL data stream.
You could just as easily use Kerberos to encrypt HTTP traffic as SSL, and that is indeed exactly what Kerberos does for just about any communications protocol...
Kerberos telnet is as encrypted as it gets.
Re: (Score:2)
I seriously have been told by the FNAL folks that they consider SSH less secure, as it is much more complicated. They also don't trust it, as some of the auth protocols have been rewritten several times because of security-related "oversights".
Anyhow, my original point is that just because the original poster doesn't know how to use telnet securely doesn't mean there aren't large, secure sites which rely on telnet
Re: (Score:2)
Re: (Score:2)
It really beats me, how this is 'Insightful' as of now at +4 ??
What also beats me, that a default install of Solaris 10 seems to have it open. Idiots. Was just sitting at one and saying to myself: Let's show it is harmless. And post to Slashdot. And voilà, there I was. Open. Fscking dimwits. No, it wasn't me opening it up. Can't you trust anyone these days ?
I really adore Theo's resolve that boxes need to be unlocked instead of locked
Re:Why is this a big deal? (Score:5, Informative)
Who the hell even THINKS about enabling telnet on any box these days?
Sadly, a whole lot of people. I work for a company that makes very expensive and cool specialty servers that perform certain security related functions. As a security company, naturally we take care not to tarnish our reputation by leaving these servers vulnerable themselves. We try to encourage our customers to be moderately responsible as well, as any box can be made insecure. I know of at least on tier-1 ISP that has one of our boxes sitting publicly accessible with telnet enabled and no IP access restrictions.
As for who uses telnet in general, most ISPs in Asia seem to use telnet to configure their systems via their control networks. Large financial institutions in Europe use telnet, as use of encryption is restricted on their trusted networks, for reasons of transparency to the stock regulating authorities. ISPs in South America often use telnet and provide shell accounts to customers. I'm sure there are more groups that use it for one reason or another.
Telnet? (Score:2)
Re: (Score:2, Informative)
It is on the 06/06 release of Solaris 10.
Re: (Score:2)
Re: (Score:3, Informative)
You can check it for yourself in vmware, if you do not believe.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I run telnet.... (Score:2, Informative)
Re:AIX Telnet? (Score:2)
I would encourage anyone that they need to harass their marketing rep, and get IBM to "officially" support OpenSSH, and at least supply it on the base AIX install media.
not an excuse (Score:5, Insightful)
Re: (Score:2)
* Might have to do with only having 64MB of memory available. Of course, there's security there, too -- the server has 2GB of hard drive space and 64MB
the authors seem very confused ... (Score:3, Insightful)
Then they start a tirade against sending passwords in the clear.
After that they say the fix is not to use telnet.
Putting aside the holier (more secure) than thou attitudes here about telnet security. I've got to say that not using something because it's broken is never a fix (unless you're a manager). The fix is to mend the problem. In the meantime, maybe, avoid the service. but bear in mind, someone still has to fix it.
Re: (Score:2)
Telnet is a security risk, even if this bug were fixed. Telnet is still considered a risk on other systems which don't have this vulnerability.
Re: (Score:2)
I would not suggest overlooking that GLARING flaw with telnet.
Yes, we should consider this particular bug a serious flaw in need of repair. But it seems like something of an absurdity to worry about one critical security flaw while ignoring another just because it counts as a "feature" rather than a "bug".
I've got to say that not using something because it's
OpenSolaris as a development model (Score:2, Informative)
The good news is that a third party has informed Sun of the info, who will now fix it.
The bad news is that we have no idea how long people have known about this problem...
Re: (Score:3, Insightful)
But in a closed development model we would have some magic insight in how long people have known about a flaw? I'm sorry, but I fail to see the drawbacks in this case.
Re: (Score:2)
Being open won't have helped in this case, people found an almost identical issue in AIX 3, which is closed. I wonder how many enterprising script kiddies went trying to exploit the AIX vulnerability, and accidentally got into a Solaris machine.
0-day? (Score:3, Interesting)
I generally don't follow Solaris, and 11 might have just come out, but I seriously doubt 10 and 11 both came out at the same time.
Re:0-day? (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The Exploit (Score:4, Informative)
So stupid.
We're not in the 90s anymore (Score:2)
Didn't work on Solaris 10 01/06 (Score:5, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Informative)
I ran the following to disable telnet
inetadm -d svc:/network/telnet:default
I just got this in my inbox from Microsoft (Score:3, Funny)
From: Steve Ballmer
Subject: Pwned
Body:
Microsoft:1 - Unix: NIL LOLOLOLOLOLOL!!!!!!!111
Love Steviepoo
yeah right.... (Score:2)
Guh! (Score:2)
Data Ge
MUDs ok? (Score:2)
Re: (Score:3, Informative)
Long answer: Even if there were a breach in the security of your mud, it would only allow access as the user running the mud daemon. Usually that isn't root. (with telnetd, of course, it usually is root)
Longer answer: The specific vulnerability here covers the way that telnetd passes arguments to the program login. Specifically, it passes what telnetd thinks is a parameter, but login interprets the passed result as an option. Presumably, your MUD server isn't turning around and calling
telnetd NOT on "by default" in Solaris 10 (Score:3, Insightful)
You can either turn on everything (telnetd, ftpd, etc, etc), or only have sshd running when the box comes up for the first time.
So saying that telnetd is on "by default" isn't exactly correct, unless your definition of "by default" is "explicitly enabled".
- Roach
Re:Here come the fanboys (Score:5, Informative)
Still, first poster is right. Wtf uses telnet anymore, unless they're dealing with the most legacy of legacy crap.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Re:Here come the fanboys (Score:5, Informative)
Re: (Score:2)
Re: (Score:3, Informative)
Not anymore, netcat [wikipedia.org] is a better replacement for creating sockets. One of its advantages is the ability to listen to ports.
Re: (Score:3, Informative)
Doing that uses a telnet client. This article is about a telnet server.
Re: (Score:2)
Re: (Score:3, Insightful)
Although I suspect you just have no idea what you're talking about and it's not doing that.
Re: (Score:3, Insightful)
The thing is, you can tunnel pretty much anything over anything, and telnet would be pretty easy to tunnel over. In fact, if you really wanted you could tunnel SSH over Telnet, and retain the encryption. So, there is absolutely no reason to leave Telnet unblocked and SSH blocked. Furthermore, in an institutional environment like a school, you could just not install SSH clients, and not give the students sufficient privileges to run their own, which is more effective than blocking particular ports. As long a
Blocking ports- a poor excuse for packet shaping (Score:3, Insightful)
If you want to filter, get a packet shaper and stop using ports; all you do by blocking ports is encourage people to ab
Re:Configuration issue (Score:5, Informative)
Re:Configuration issue (Score:5, Informative)
1) this attack does not work:
Escape character is '^]'.
Not on system console
Connection closed by foreign host.
2) when installing U3 one can opt to close most services. This could be also done after installation with "netservices limited" command.
Re:Configuration issue (Score:4, Informative)
This has been confirmed on the latest version of Solaris 10.
Re: (Score:3, Informative)
> Not on system console
> Connection closed by foreign host.
Reason that message happened: You succesfully logged in as root. However,
And for the people saying, "OMG! Who uses telnet anymore?!?!", remember that with Solaris (at least up until my experience with 10), it comes out of the box with Telnet *enabled*. It isn't people who enabled telnet that a
Re: (Score:2)
Re: (Score:2, Informative)
Its not a buffer overflow, its just unvalidated input.
Re: (Score:2)
We'll just suddenly and completely rewrite nearly every operating system we use. Yeah, that shouldn't be too hard!
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)