[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20260225194709.3XDsVdwv@steffen%sdaoden.eu>
Date: Wed, 25 Feb 2026 20:47:09 +0100
From: Steffen Nurpmeso <steffen@...oden.eu>
To: oss-security@...ts.openwall.com
Subject: Re: Telnetd Vulnerability Report
Solar Designer wrote in
<20260225165449.GA23380@...nwall.com>:
|On Wed, Feb 25, 2026 at 07:46:07AM -0500, kf503bla@...k.com wrote:
|> telnet is extremely old and just because there is still widespread \
|> use of telnet or the daemon, doesn't provide a valid reason to keep \
|> using it. these trivial vulnerabilities keep popping up and if you \
|> still insist of using telnet, you deserve getting pwned
|
|I mostly let these messages through so far (rejecting only one, which
|had even less value), but as a moderator I declare end of sub-thread
|now. Further messages on "Who uses telnet anyway?" will be rejected by
|default, unless they truly add something new.
It seems to me one reason to use telnet(1) arises from the fact
that there is no nc(1) around. busybox has one, but it is not
feature rich enough. And the one of LibreSSL, which is, as it
says, a swiss-army-knife, is very often not available at all.
So for example on AlpineLinux you have busybox/nc by default,
but need the "community" libressl-nc otherwise (and it is ~1.6MB,
not ~160KB); ditto ArchLinux, it does even seem to explicitly
exclude it from its "extra" package libressl.
On the BSDs it is better, they have the nc from way over a decade
ago, but refrain from updating (FreeBSD; dunno NetBSD: simply do
not update?) due to that being non-trivial. DragonFly BSD is
different, as they have imported LibreSSL, and simply use the
nc(1) that ships with that (LibreSSL include that libtls that nc
now uses).
|Messages on actual security issues/fixes in telnet are still desirable.
(Only to mention that i would not even offer telnet or rsh even
inside a VPN, as was heard.)
|Alexander
|
|P.S. I first wrote the above in a confusing manner, not clarifying it's
|only end of sub-thread started by kf503bla, not the entire thread.
|Corrected now, and I'll only let this corrected message to oss-security.
--End of <20260225165449.GA23380@...nwall.com>
I do not know of "upgraded" ports of neither FreeBSD nor NetBSD
variants of nc(1) (usr.bin/nc), which include several iterations
and still make use of "normal OpenSSL" interface. But sounds like
a valuable thing to do.
--steffen
|
|Der Kragenbaer, The moon bear,
|der holt sich munter he cheerfully and one by one
|einen nach dem anderen runter wa.ks himself off
|(By Robert Gernhardt)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
