From owner-freebsd-security@FreeBSD.ORG Fri Dec 23 17:35:38 2011 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A95181065678 for ; Fri, 23 Dec 2011 17:35:38 +0000 (UTC) (envelope-from bounces+73574-f30d-freebsd-security=freebsd.org@sendgrid.me) Received: from o1.shared.sendgrid.net (o1.shared.sendgrid.net [74.63.231.244]) by mx1.freebsd.org (Postfix) with SMTP id 411D38FC1E for ; Fri, 23 Dec 2011 17:35:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sendgrid.info; h= message-id:date:from:mime-version:to:cc:subject:references :in-reply-to:content-type:content-transfer-encoding; s=smtpapi; bh=ZJ0XTUjmy0Uk+0D4aRlQRaYNNDw=; b=Un5CcJvWYZxKxbvTgSp/BDYiO4y7 SnpxgCA2TWFlKNh9yX+RYTBp5VJYcZGf9NQMtabBC5trjAJHmDqn1zI3GCWWTSic qrx7XTRsEALH/v3rKjfW7Vp8bO2DX/8qVCTHT8INtaEBYnrDuh/OAIhuzX62ESG7 O9y5WmBjMFSkdz4= Received: by 10.41.149.159 with SMTP id f04-24.32761.4EF4BBD33 Fri, 23 Dec 2011 17:35:15 +0000 (UTC) Received: from mail.tarsnap.com (unknown [10.41.149.212]) by i04-03 (SG) with ESMTP id 4ef4bbc4.3a9d.1c0048d for ; Fri, 23 Dec 2011 17:35:00 +0000 (UTC) Received: (qmail 75229 invoked from network); 23 Dec 2011 17:34:54 -0000 Received: from unknown (HELO clamshell.daemonology.net) (127.0.0.1) by mail.tarsnap.com with ESMTP; 23 Dec 2011 17:34:54 -0000 Received: (qmail 61406 invoked from network); 23 Dec 2011 17:34:45 -0000 Received: from unknown (HELO clamshell.daemonology.net) (127.0.0.1) by clamshell.daemonology.net with SMTP; 23 Dec 2011 17:34:45 -0000 Message-ID: <4EF4BBB5.2030900@freebsd.org> Date: Fri, 23 Dec 2011 09:34:45 -0800 From: Colin Percival User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:8.0) Gecko/20111112 Thunderbird/8.0 MIME-Version: 1.0 To: Tim Zingelman References: <4EF4A120.1000305@freebsd.org> In-Reply-To: X-Enigmail-Version: undefined Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Sendgrid-EID: 5qVSvszVOIE6PbdhSmXigMotnDv2KVF2pFB0fKg9Jzq2syuD2XJCVRnNIJhoirEwzBESx9PrCFvddaHBDa2OxUMUAIQNSvJzp9v0GazDqpKwoYzxLnZTeee3W40nGumnKZEs/UBdYOFJv8QccsQ1WrcnDSXpIbWd1z96qDUIG+A= Cc: freebsd-security@freebsd.org Subject: Re: Merry Christmas from the FreeBSD Security Team X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Dec 2011 17:35:38 -0000 On 12/23/11 09:08, Tim Zingelman wrote: > On Fri, 23 Dec 2011, FreeBSD Security Officer wrote: >> Unfortunately my hand was forced: One of the issues (FreeBSD-SA-11:08.telnetd) >> is a remote root vulnerability which is being actively exploited in the wild; >> bugs really don't come any worse than this. On the positive side, most people >> have moved past telnet and on to SSH by now; but this is still not an issue we >> could postpone until a more convenient time. > > Is there any reason this does would not apply to telnetd from most other > vendors? In particular MIT Kerberos & heimdal? It probably applies to everyone shipping BSD telnetd -- I notified the projects I could think of, but I'm sure I missed a few. Heimdal is definitely affected. I don't think MIT Kerberos ships telnetd any more... at least, I looked in their SVN tree and didn't find it. -- Colin Percival Security Officer, FreeBSD | freebsd.org | The power to serve Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid