Date: Fri, 23 Dec 2011 09:34:45 -0800 From: Colin Percival <cperciva@freebsd.org> To: Tim Zingelman <zingelman@fnal.gov> Cc: freebsd-security@freebsd.org Subject: Re: Merry Christmas from the FreeBSD Security Team Message-ID: <4EF4BBB5.2030900@freebsd.org> In-Reply-To: <Pine.SOL.4.64.1112231103280.23931@nova.fnal.gov> References: <4EF4A120.1000305@freebsd.org> <Pine.SOL.4.64.1112231103280.23931@nova.fnal.gov>
next in thread | previous in thread | raw e-mail | index | archive | help
On 12/23/11 09:08, Tim Zingelman wrote: > On Fri, 23 Dec 2011, FreeBSD Security Officer wrote: >> Unfortunately my hand was forced: One of the issues (FreeBSD-SA-11:08.telnetd) >> is a remote root vulnerability which is being actively exploited in the wild; >> bugs really don't come any worse than this. On the positive side, most people >> have moved past telnet and on to SSH by now; but this is still not an issue we >> could postpone until a more convenient time. > > Is there any reason this does would not apply to telnetd from most other > vendors? In particular MIT Kerberos & heimdal? It probably applies to everyone shipping BSD telnetd -- I notified the projects I could think of, but I'm sure I missed a few. Heimdal is definitely affected. I don't think MIT Kerberos ships telnetd any more... at least, I looked in their SVN tree and didn't find it. -- Colin Percival Security Officer, FreeBSD | freebsd.org | The power to serve Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4EF4BBB5.2030900>