Mac OS X & Darwin/BSD vulnerable to telnetd overflow

From: Nathan Ollerenshaw (chrome@stupendous.net)
Date: 07/28/01 

Message-Id: <p05101003b787f9694230@[195.149.51.21]>
Date: Sat, 28 Jul 2001 06:17:50 +0100
To: bugtraq@securityfocus.com
From: Nathan Ollerenshaw <chrome@stupendous.net>
Subject: Mac OS X & Darwin/BSD vulnerable to telnetd overflow

[titanium:~/desktop] chrome% ./SPtelnetAYT localhost
Telnetd AYT overflow scanner, by Security Point(R)
Host: localhost
Connected to remote host...
Sending telnet options... stand by...
Telnetd on localhost vulnerable
[titanium:~/desktop] chrome% telnet localhost
Trying 127.0.0.1...
Connected to localhost.stupendous.net.
Escape character is '^]'.

Darwin/BSD (titanium) (ttyp5)

login: ^]
telnet> close
Connection closed.

Note that by default telnet is disabled in /etc/inetd.conf (as are
most things, except for portmapper/NFS, ugh) so the impact should be
minimal. If you're not using the OpenSSH included with OS X, you're
mad.

This was tested successfully on Mac OS X 10.0.4 from both the local
machine, and from a remote Sparc Solaris 2.7 host.

I'd notify Apply, only I have no idea what address to use, and it's
6am and I've not slept yet (catching up to bugtraq from a 2 week
holiday, wow, that Code Red thing was bad, glad I wasn't around when
THAT baby hit, ho ho ho)

Nathan. 

-- 
"The computer can't tell you the emotional story.
  It can give you the exact mathematical design, but
  what's missing is the eyebrows." - Frank Zappa

Relevant Pages

  • Re: No route to host
    ... route to host" is returned. ... three telnet tests to try and the results are below. ... Connection closed by foreign host. ...
    (comp.mail.sendmail)
  • Re: Multiple Tunnel question - (client part)
    ... Ok,thank you now the tunnel between linux2 and linux1 works. ... Connected to localhost. ... PCcygwin% telnet linux1 2200 ... telnet: Unable to connect to remote host: Connection refused ...
    (comp.security.ssh)
  • Re: Possibly OT: sending email from shell scripts on cygwin
    ... $ telnet your-smtp-server 25 ... With the outgoing SMTP server I have configured for Thunderbird (smtp.comcast.net using port 587) I get this for the 3 ports we've seen mentioned in this thread: ... Connecting To smtp.comcast.net...Could not open connection to the host, ...
    (comp.unix.shell)
  • Re: rlogin
    ... We have only 1 host system. ... Remote login made via telnet is insecure and has no protection, ... > recommended them to have a SSH connection, ... > telnet session of the terminal emulation software can still access the ...
    (comp.unix.aix)
  • [Info-ingres] Re: IIR3 and vnodes
    ... Also I've confirmed the host is listening on the 'II' installation with tcp_ip. ... If I change to using an installation password the connection succeeds. ... I cant telnet to the host, but I can scp to it. ... brat.ingres> telnet localhost ...
    (comp.databases.ingres)