telnetd

The mystery is how that single long string in telnetd becomes two separate arguments for login.

Connections are handled by telnetd, and the interface is basically considered a shell by the system.

The bug was a blindingly obvious buffer overflow, but nobody goes digging through telnetd looking for encryption code.

If GNU telnetd is vulnerable and it's running on port 23/tcp, it will be found on IPv6.

It spiked a bunch around the time of the telnetd cve, but that's to be expected.

It is a horse of a different color when user logins are handled by telnetd itself.

Just ask any Unix admin where MUD users try to bang on their telnetd port trying to play the game...

These are the retail standard AR Drones with their own Wifi APs and telnetd enabled.

Practically nobody runs telnetd(8) anymore since the introduction of encryption, ssh, and the like.

I am surprised that they were so easily able to usurp telnetd if this was the status quo.

Pre-auth buffer overflow in telnetd's SLC handler, sitting in the codebase since 1994.

There are two facets to January's incident: the vulnerability in the GNU implementation of telnetd, and the purported, widespread blocking of port 23.

They will indeed get inside "your" computer, or router, and then compromise your telnetd.

My "favourite" FreeBSD advisory was the 2011 telnetd "christmas present" -- remote root to any system running telnetd with the default options.

I'm slightly taken aback by the telnetd fix: The solution to the username "-f root" being interpreted as two arguments to /usr/bin/login is to add a "sanitize" function, really?