Re: 3Com SuperStack 3 Firewall Content Filter Exploitable Via Telnet

From: der Mouse (mouseat_private)
Date: Wed Mar 05 2003 - 18:14:38 PST

  • Next message: securityat_private: "Security Update: [CSSA-2003-SCO.4] UnixWare 7.1.1 Open UNIX 8.0.0 UnixWare 7.1.3 : Lax permissions on /dev/X"

    >> C:\>telnet www.blockedsite.com 80
    >> GET / HTTP/1.1
    >> Host: www.blockedsite.com
    
    >> Given the nature of Telnet, the request is sent to the server one
    >> character at a time;
    > Actually, in these situations, telnet works line-based.
    
    In those situations (where character-at-a-time has not been negotiated
    on), telnet is _supposed_ to work line-based.
    
    Unfortunately - see that "C:\>"? - most wintel telnets were written by
    people who either didn't understand the standard or were incompetent to
    follow it (or perhaps just couldn't be bothered? I dunno) and use
    character-at-a-time mode even when it hasn't been negotiated on.
    
    > That's also why backspace works (modulo matching terminal emulator
    > and stty settings).
    
    In wintel telnets, backspace often _doesn't_ work, because of exactly
    that, though it may look like it when typing because the echo of the
    0x08 octet (whichever end generates the echo) makes the cursor move
    leftwards....
    
    I know all this because I am server code wiz for a mud, and I've hacked
    in kludges to work around some of the most egregious problems I've seen
    in various telnets.  (All the problematic telnets have come from an
    infamous company based in Redmond, oddly enough.)  Mercifully, one of
    the other people who uses that mud (a) muds from Windows and (b) is
    technically clued, an odd combination but one that's useful when
    testing such things.)
    
    /~\ The ASCII				der Mouse
    \ / Ribbon Campaign
     X  Against HTML	       mouseat_private
    / \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
    



    This archive was generated by hypermail 2b30 : Thu Mar 06 2003 - 10:33:12 PST