In some mail from Gadi Evron, sie said:
On Tue, 13 Feb 2007, Michael Wojcik wrote:
From: Thierry Zoller [mailto:Thierry@Zoller.lu]
Sent: Monday, 12 February, 2007 07:52
GE> telnet -l "-froot" [hostname]
Should we really consider this a BUG ? With all due respect, this
reads, smells and probably tastes like a backdoor
It's a bug. I recall it being found and fixed in AIX many years ago.
Embarassing for Sun that it's still in Solaris, though.
It's actually caused by a "feature" of login; the bug is in programs
that exec login and pass "-froot" to it, and in preserving this feature
of login at all.
A quick Google search found Usenet postings about it from 1994; I'm sure
it was known well before then.
Hi Michael. Thank you for making that issue public (about login). Haven't
seen it posted anywhere.
One note: although it could just as well be a bug, who says it was not a
backdoor in the early 90's?
Also, I understand this does not work on older Solaris/SunOS systems
(anyone can verify?) which adds to my personal interest in the
possibility. I refuse to believe someone is that funny/sad.
See Casper Dik's email about when it was introduced...
He's not lieing...which is to say your email should not
have made it out to the list....
I just tried it locally with 5.7 and the result was:
$ telnet -l -froot localhost
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Have you considered using SSH?
login:
telnet> Connection closed.
There are two methods to pass information through to telnet from
a remote connection as part of the telnet protocol:
- username
- terminal type
If either of these are passed through to the command line of /bin/login
then precautions need to be taken.
Darren
