SANS ISC: Telnet client vulnerability; DNS posioning re-appearing

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Comments about Infocon

We have received numerous valuable comments about our infocon system. Thanks for all the comments. In the next few days, we will come up with a plan to improve the system. Stay tuned.

Telnet client vulnerability

There are two new similar vulnerabilities affecting telnet clients on FreeBSD, variants of Linux, Solaris and OS X. Together with the telnet exploitation that we reported couple days ago, it should be a warning for those who haven't disabled telnet on their network.



Disable all telnet daemons on your machines, use SSH instead. If you really don't need the client, consider removing it or disable the execution bit on the file.



References:

http://www.idefense.com/application/poi/display?id=220&type=vulnerabilities&flashstatus=true

http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities&flashstatus=true

DNS poisoning still around

We have received a few more reports of DNS poisoning, we think it is the previous attack re-appearing and are handling it. Please let us know if you are seeing this attack again.





-------------

Jason Lam, jason / at / networksec.org