Telnetd vulnerability, or, dealing with ancient software

Friday, August 26, 2022

Pierre Kim notes a Denial-of-Service vulnerability in various implementations of telnetd. Well, duh, as they say. As Kim’s post mentions, a lot of this code hasn’t been updated in 30 years. It’s hardly surprising that code in BSD 4.3 Reno, UNICOS, SunOS, DYNIX, and Ultrix—all of which have long since been discontinued—should have such vulnerabilities. This isn’t a problem, since nobody is using those today.

The problem is that telnetd is not just in these old operating systems, but is available in current versions of FreeBSD, NetBSD, and essentially every Linux distribution.

Kim’s post makes the recommendation, “It is 2022. Do not use telnet. Seriously!” I think this is wrong, or rather, misses the point. A better recommendation would be “Remove telnetd from your operating system.”1

Programs which don’t exist can’t have bugs. Do not ship known-vulnerable code. Just don’t.

Footnotes:

1

The OpenBSD Project removed it in in 2005, in the leadup to OpenBSD 3.8. Microsoft removed it from their workstation OS branch with Windows Vista in 2006, and the server branch with Windows Server 2016. Apple removed it in 2017, with the release of Mac OS X 10.13 “High Sierra.” The telnet client is still available by default in OpenBSD. Windows installations do not include the client by default, but it can be installed by going to “Turn Windows features on or off” or via Powershell. The telnet client is not available at all from Apple, post-10.13 (though you can install it via Homebrew).