On Sun, 8 Mar 2026 03:57:45 +0100, Solar Designer wrote: others have. It may well be that allowing those other env vars by and maybe allowing LANG and LC is desirable for current use cases. LANG and LC were cargo-culted in as they are honoured by OpenSSHd. Separately note that I didn't check the BSDs telnet client (which I think is still present in all BSDs) for being (hopefully not) willing And you could want to check the telnet client in InetUtils, now that we know this package missed telnet[d] security fixes in general. This was CVE-2005-0488 (and CVE-2005-1205 on Windows).

"Certain BSD-based Telnet clients, including those used on Solaris and SuSE Linux, allow remote malicious Telnet servers to read sensitive command."

The daemon now clears the inherited environment (preserving PATH and TERM, respectively, if present) before calling telnetdsetup(). LDPRELOAD=/lib64/libhardenedmalloc.so (although /etc/ld.so.preload is a more reliable way to do this when practical to do it globally).

exorciseenv() and leave the inetd/tcpd supplied environment intact for telnetd (or some site-specific wrapper) to inherit. +++ b/telnetd/state.c @@ -1495,10 +1495,18 @@ suboption (void) case NEWENVVAR: case ENVUSERVAR: ... } / end of case TELOPTNEWENVIRON /

Some code duplication here. Not new with these changes, but could be worth moving to a new function e.g. setenvvarifallowed(). Agreed. I'll implement setenvvarifallowed() instead. +/ A default whitelist for environment variables. / +static const char allowedenvvars[] = { + "USER", + "LOGNAME", + "TERM", + "LANG", + "LC", + NULL +};

Can make not only the strings but also the pointers const:

static const char const allowedenvvars[] = {

so that both may end up in a read-only section. OK, .rodata it is. +int +isenvvarallowed (const char var, const char val) +{ + const char p; + int allowed = 0; + + for (p = allowedenvvars; p; p++) + { + if (fnmatch (p, var, FNMNOESCAPE) == 0) + { + allowed = 1; + break; + } + } + + if (!allowed) + return 0;

You didn't strictly need the "allowed" variable, you could check p after the loop. But maybe it's more readable the way you wrote it. I'll keep "allowed" for the time being, but I don't mind changing it if there's a clearer way to express this logic. My review above isn't in full context - I only looked at the patches.

The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets.

BSD compress implemented an LZW compressor and decompressor. This decompressor implementation did not correctly handle compressed streams that contain code words that were not yet added to the decompression table. LZW decompression has a special case (a KwKwK string) when code word may match the first free entry in the decompression table. The implementation used in BSD compress allow code words not only matching, but also exceeding the first free entry.

It seems this compress implementation first appeared in BSD around 1985, and was later used in various other code base, such as ncompress and gzip. Other components that contain affected code will be listed below. Following page list the version of the code as was used in 4.3BSD:

http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/compress/compress.c

Relevant code appears in the decompress() routine:

/ Special case for KwKwK string. / if ( code >= freeent ) { stackp++ = finchar; code = oldcode; }

This allows creating a loop in the decompression table, which leads to an "infinite" loop:

/ Generate output characters in reverse order / #ifdef SIGNEDCOMPARESLOW while ( ((unsigned long)code) >= ((unsigned long)256) ) { #else while ( code >= 256 ) { #endif stackp++ = tabsuffixof(code); code = tabprefixof(code); }

where tabprefixof is:

unsigned short codetab [HSIZE]; #define codetabof(i) codetab[i] #define tabprefixof(i) codetabof(i)

This overflows destack "buffer" (part of the htab[]):

countint htab [HSIZE]; # define tabsuffixof(i) ((chartype )(htab))[i] # define destack ((chartype )&tabsuffixof(1<<BITS))

Depending on the relative htab[] and codetab[] positions, destack overflow may overwrite codetab[] entries, which may break infinite loop and let program continue its execution with possibly corrupted memory.

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php.

Buffer overflow in the lprm command in the lprold lpr package on SuSE 7.1 through 7.3, OpenBSD 3.2 and earlier, and possibly other operating systems, allows local users to gain root privileges via long command line arguments such as (1) request ID or (2) user name.

Format string vulnerability in nvi before 1.79 allows local users to gain privileges via format string specifiers in a filename.

Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue.

lpr on SunOS 4.1.1, BSD 4.3, A/UX 2.0.1, and other BSD-based operating systems allows local users to create or overwrite arbitrary files via a symlink attack that is triggered after invoking lpr 1000 times.

BSD 4.4 based operating systems, when running at security level 1, allow the root user to clear the immutable and append-only flags for files by unmounting the file system and using a file system editor such as fsdb to directly modify the file through a device.

The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID.

Vulnerability in BSD Telnet client with encryption and Kerberos 4 authentication allows remote attackers to decrypt the session via sniffing.

Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.