3 ms·

A 32-Year-Old Bug Walks into a Telnet Server

2 points by paimapi 16d ago

deleted 15d ago
[deleted]
collinfunk 15d ago
As the person who wrote the fix for this issue (and not the original code), I will just mention that I find this paragraph makes the author sound incredibly entitled: Shamefully, the inetutils project hasn’t actually released a fixed version of their software (at least at the time of publishing). The bug was reported on a public mailing list, which is sadly common nowadays [1]. After my workday, during which I was not able to review the report, I wrote a script to confirm the bug was real, since I was seeing way too many slop reports at the time. Then I sent a patch before going to bed [2]. A third party then graciously shared the patch on oss-security [3], which all distributions follow. There is no need to make a new release, which is harder for the distributions than simply applying a small patch. Perhaps I am just unlucky in my interactions, but I feel like this entitlement is too common among software security people. Note that I see zero return in spending time working on Inetutils, and I find other projects I work on more interesting. [1] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [2] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00032.html https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [3] https://www.openwall.com/lists/oss-security/2026/03/12/4 https://www.openwall.com/lists/oss-security/2026/03/12/4
- taftster 15d ago
  It's an unfortunate statement. And it does feel like it discredits you and the heroic efforts of those like you. But this is probably forgiven as just sensationalism in writing, which is all too common. Not to excuse the author, but these types of writeups tend to drift into name calling and finger pointing a little too soon. "Shamefully" is definitely the wrong word here, for sure.
  - JoshTriplett 14d ago
    > But this is probably forgiven as just sensationalism in writing Why should we forgive sensationalism in writing at all?
- x______________ 15d ago
  The not-so-silent minority hanging out on HN know that the true heroes are those who take the time and put in the effort, and then put even more effort to reply and post about it here. Thanks to all of our heroes, op included.
  - deleted 14d ago
    [deleted]
  - TacticalCoder 14d ago
    > The not-so-silent minority hanging out on HN know that the true heroes are those who take the time and put in the effort, and then put even more effort to reply and post about it here. We know that the entirety of the AI movement is built on top of open-source projects like Linux and all the terminal and command line utilities. And runs inside projects doing god's work (say to contain the agents) like QEMU etc. AI lives inside the work of our open-source heroes and would be absolutely nowhere without the work of all those people. > Thanks to all of our heroes, op included. Definitely, thanks GP and thanks to all our heroes.
- saidnooneever 14d ago
  you are right they are entitled brats. usually they cant write good code themselves and they purposefully look for very old or low traffic code to find things that are 'old' etc. to make stupid uninteresting AI generated blog posts. i have not seen a decent writeup in one of these clickbait things these ppl push out. just ignore these types of ppl. its fine to fix the bugs ofc but what i mean is, ignore their attitudes. its a kids' attitude to life they keep
- croemer 14d ago
  Thanks for maintaining telnet. The bug was reported on a public mailing list, which is sadly common nowadays In defence of the reporter, your Readme only says "Send bug reports to bug-inetutils@gnu.org.", there is no distinction for vulnerabilities. [1] There is a 3 months old pull request to advertise a private reporting email address but it's unmerged, maybe you could use this renewed interest as a nudge to set it up and merge: https://codeberg.org/inetutils/inetutils/pulls/26 https://codeberg.org/inetutils/inetutils/pulls/26 One other thing the reporter could have done to make your life easier is to write a repro script rather than just explain the steps in prose. [1]: https://codeberg.org/inetutils/inetutils/src/commit/40f19d84c3dead93e6fef7fc1150fde5210ebdab/README.md?display=source#L8 https://codeberg.org/inetutils/inetutils/src/commit/40f19d84...
- trollbridge 14d ago
  Thank you for maintaining Telnet! I still keep it around mostly for retro computing purposes to interact with very old operating systems or with machines that aren’t capable of encrypting in any reasonable amount of time.
- PunchyHamster 14d ago
  Security culture in general seems to be very entitled and toxic, the absolute disconnect from reality some of them get needs to be studied
- cisrockandroll 14d ago
  The entire infrastructure of the world relies on free open source software written 30 years ago. And then all governments and corporations demand immediate support as if they have paid Tier 3 SLA with the unpaid maintainers lol.
deleted 15d ago
[deleted]
notimetorelax 15d ago
I really dislike articles that blow out of proportion the technical details. TLDR; bounds checking was missing leading to potential memory corruption.
- ErroneousBosh 14d ago
  > TLDR; bounds checking was missing leading to potential memory corruption. ... if you hold it just right, and let the light of the full moon shine through it on a particular day, while you send a carefully-crafted packet through the right brand of NIC over cables forged by long-forgotten smiths.
jeffbee 15d ago
RISC was not a distant dream in 1994 LMAO.
- b800h 14d ago
  That made me spit out my tea. The prose was insulting.
  - eqvinox 14d ago
    I stopped reading on that line. The entire text is coming off as insulting, entitled and smug.
- wolfi1 14d ago
  at that time even Intel had a RISC cpu (i960)
  - ErroneousBosh 14d ago
    RISC desktop computers were common-ish in UK schools by then. Of course if you count the 6502 as a RISC chip (if you squint a bit, Page Zero RAM sure does look like 256 8-bit registers to me!) then UK schools had RISC desktops for over a decade before then!
krautsauer 15d ago
Needs a (March 19) (I know HN only does this for years, but this being about vulnerabilities…)
khrbtxyz 15d ago
A surprisingly long article for a one-line fix the authors didn’t send.
- Skywalker13 15d ago
  Since AI is redacting, a lot of articles are long and boring to read with a lot of useless details.
  - croemer 14d ago
    Redacting what? Did you mean write or edit?
    - Skywalker13 14d ago
      "rédiger" in french, then it's "write" instead of "redacting" I suppose.. sorry for my poor english
      - croemer 14d ago
        Thanks, makes sense! No need to be sorry!
      - Timwi 14d ago
        Yeah that's “edit” in English.
sjpb 15d ago
If you're going to rip off xkcd pictures, I feel it'd be polite at least credit and/or link the original.
- velcrovan 14d ago
  xkcd pics are provided under a Creative Commons Attribution/Non-commercial license, so attribution is required but using them is ok.
  - ninju 14d ago
    Yeah but its also quite trivial to give them credit https://xkcd.com/2347/ https://xkcd.com/2347/
- deleted 14d ago
  [deleted]
- Timwi 14d ago
  I had the same thought. This is honestly plagiarism.
mitxela 15d ago
FYI all signalling is in-band signalling
- ErroneousBosh 14d ago
  And all signals are analogue, if you're paying enough attention to the transients ;-)
b800h 14d ago
> "1994" > "RISC was a distant dream" Ahem
- dspillett 14d ago
  Maybe I'm in a generous mood, but I would credit the writer with making a joke about the content of the film they had just mentioned and subsequently show a screen cap of work the subtitles for a line about RISC being a significant future technology, rather than being that historically inaccurate in their own tech memory.
  - b800h 14d ago
    Oh yes, "RISC is going to change everything". I remember that line. Clunky from the author, I think.
- richrichardsson 14d ago
  Was just coming to comment on that too. "Tell that to the ARM based Acorn Archimedes I was using at 6th Form College in 1991."
  - icedchai 14d ago
    Or all the Sun Sparc servers that were incredibly common at that time. Coincidentally, they almost all ran telnet!
johnnyApplePRNG 14d ago
Something tells me the NSA is none too pleased about the advent of LLMs. Or is there a tradeoff? Fewer ancient holes like this for their hackers but wide open access to anyone who installs codex or claude code?
- spydum 14d ago
  I know people seem to think nsa and other gov threat actors live in a land of zero days and advanced techniques... And to some degree, they sure do develop those and are able to leverage them. However, from my point of view most targets are able to be compromised by poor configs, hygiene, well known and patchable vulns, or the more likely avenue: the humans operating the system.
ErroneousBosh 14d ago
> In fact, this vulnerability was born so long ago (way back in 1994) > That was so long ago that RISC was still a distant dream. Yeah ARM would like to have a word with you. I'd been using RISC on the desktop for about five years by then and I was not an early adopter.
- j16sdiz 14d ago
  and SPARC was one of the top choice for server where telnet were run.
  - fl7305 14d ago
    and the DEC Alpha RISC CPU was on fire, and ran circles around the desktop CISC CPUs
    - ErroneousBosh 14d ago
      I wish I'd never given away my MIPS R2000-based DECStation 3100.
egorfine 14d ago
And this is why serious enterprises use telnetd exclusively instead of your childish ssh toy. See why? Because it's got ONE CVE in 3 decades as compared to a never-ending flow of security vulnerabilities in ssh. Security! /s
e12e 14d ago
Wow, how did this not get discovered and fixed at the time of: https://www.cve.org/CVERecord?id=CVE-2007-0882 https://www.cve.org/CVERecord?id=CVE-2007-0882 Might be a 32 year old bug, but it's practically also a 19 years old exploit? Ed: I'm confusing TFA with https://nvd.nist.gov/vuln/detail/cve-2026-24061 https://nvd.nist.gov/vuln/detail/cve-2026-24061 Which seems pretty much identical with the 2007 cve.
Rooster61 14d ago
The server asks the bug "Why the long face?". The bug, being a bug, proceeds to overflow the buffer
mzs 14d ago
CVE-2026-32746
JdeBP 13d ago
A lot of people have already made almost all of the same observations that I was going to make. Except for: There is no bug that originates in a GNU version of an old networking program and magically makes its way into the NetBSD, FreeBSD, DragonFlyBSD, and OpenBSD (Yes; I checked.) versions of that program. History simply didn't happen that way. This bug goes as far back at least as far as the Jolitz-released 386BSD source for libexec/telnetd , where it can be found and which is credited in the GNU versions of the file. GNU just took the 386BSD code. But BSD had a telnetd before 386BSD. In BSD, telnetd itself goes back to 1983. Although its code to do line mode did not pre-date RFC 1116, which was published in August 1989. The code to do line mode was written the month after that RFC, by Paul Borman, and the bug is in the very first version of that code: * https://github.com/dspinellis/unix-history-repo/blob/dc8d5043207cb2f457f5f15344168c2a8347079d/usr/src/libexec/telnetd/slc.c#L104 https://github.com/dspinellis/unix-history-repo/blob/dc8d504... This bug is not 32 years old.

2 points by paimapi 16d ago

deleted 15d ago

[deleted]

As the person who wrote the fix for this issue (and not the original code), I will just mention that I find this paragraph makes the author sound incredibly entitled: Shamefully, the inetutils project hasn’t actually released a fixed version of their software (at least at the time of publishing). The bug was reported on a public mailing list, which is sadly common nowadays [1]. After my workday, during which I was not able to review the report, I wrote a script to confirm the bug was real, since I was seeing way too many slop reports at the time. Then I sent a patch before going to bed [2]. A third party then graciously shared the patch on oss-security [3], which all distributions follow. There is no need to make a new release, which is harder for the distributions than simply applying a small patch. Perhaps I am just unlucky in my interactions, but I feel like this entitlement is too common among software security people. Note that I see zero return in spending time working on Inetutils, and I find other projects I work on more interesting. [1] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [2] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00032.html https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg... [3] https://www.openwall.com/lists/oss-security/2026/03/12/4 https://www.openwall.com/lists/oss-security/2026/03/12/4

taftster 15d ago
It's an unfortunate statement. And it does feel like it discredits you and the heroic efforts of those like you. But this is probably forgiven as just sensationalism in writing, which is all too common. Not to excuse the author, but these types of writeups tend to drift into name calling and finger pointing a little too soon. "Shamefully" is definitely the wrong word here, for sure.
- JoshTriplett 14d ago
  > But this is probably forgiven as just sensationalism in writing Why should we forgive sensationalism in writing at all?
x______________ 15d ago
The not-so-silent minority hanging out on HN know that the true heroes are those who take the time and put in the effort, and then put even more effort to reply and post about it here. Thanks to all of our heroes, op included.
- deleted 14d ago
  [deleted]
- TacticalCoder 14d ago
  > The not-so-silent minority hanging out on HN know that the true heroes are those who take the time and put in the effort, and then put even more effort to reply and post about it here. We know that the entirety of the AI movement is built on top of open-source projects like Linux and all the terminal and command line utilities. And runs inside projects doing god's work (say to contain the agents) like QEMU etc. AI lives inside the work of our open-source heroes and would be absolutely nowhere without the work of all those people. > Thanks to all of our heroes, op included. Definitely, thanks GP and thanks to all our heroes.
saidnooneever 14d ago
you are right they are entitled brats. usually they cant write good code themselves and they purposefully look for very old or low traffic code to find things that are 'old' etc. to make stupid uninteresting AI generated blog posts. i have not seen a decent writeup in one of these clickbait things these ppl push out. just ignore these types of ppl. its fine to fix the bugs ofc but what i mean is, ignore their attitudes. its a kids' attitude to life they keep
croemer 14d ago
Thanks for maintaining telnet. The bug was reported on a public mailing list, which is sadly common nowadays In defence of the reporter, your Readme only says "Send bug reports to bug-inetutils@gnu.org.", there is no distinction for vulnerabilities. [1] There is a 3 months old pull request to advertise a private reporting email address but it's unmerged, maybe you could use this renewed interest as a nudge to set it up and merge: https://codeberg.org/inetutils/inetutils/pulls/26 https://codeberg.org/inetutils/inetutils/pulls/26 One other thing the reporter could have done to make your life easier is to write a repro script rather than just explain the steps in prose. [1]: https://codeberg.org/inetutils/inetutils/src/commit/40f19d84c3dead93e6fef7fc1150fde5210ebdab/README.md?display=source#L8 https://codeberg.org/inetutils/inetutils/src/commit/40f19d84...
trollbridge 14d ago
Thank you for maintaining Telnet! I still keep it around mostly for retro computing purposes to interact with very old operating systems or with machines that aren’t capable of encrypting in any reasonable amount of time.
PunchyHamster 14d ago
Security culture in general seems to be very entitled and toxic, the absolute disconnect from reality some of them get needs to be studied
cisrockandroll 14d ago
The entire infrastructure of the world relies on free open source software written 30 years ago. And then all governments and corporations demand immediate support as if they have paid Tier 3 SLA with the unpaid maintainers lol.

deleted 15d ago

[deleted]

notimetorelax 15d ago

I really dislike articles that blow out of proportion the technical details. TLDR; bounds checking was missing leading to potential memory corruption.

ErroneousBosh 14d ago
> TLDR; bounds checking was missing leading to potential memory corruption. ... if you hold it just right, and let the light of the full moon shine through it on a particular day, while you send a carefully-crafted packet through the right brand of NIC over cables forged by long-forgotten smiths.

jeffbee 15d ago

RISC was not a distant dream in 1994 LMAO.

b800h 14d ago
That made me spit out my tea. The prose was insulting.
- eqvinox 14d ago
  I stopped reading on that line. The entire text is coming off as insulting, entitled and smug.
wolfi1 14d ago
at that time even Intel had a RISC cpu (i960)
- ErroneousBosh 14d ago
  RISC desktop computers were common-ish in UK schools by then. Of course if you count the 6502 as a RISC chip (if you squint a bit, Page Zero RAM sure does look like 256 8-bit registers to me!) then UK schools had RISC desktops for over a decade before then!

krautsauer 15d ago

Needs a (March 19) (I know HN only does this for years, but this being about vulnerabilities…)

khrbtxyz 15d ago

A surprisingly long article for a one-line fix the authors didn’t send.

Skywalker13 15d ago
Since AI is redacting, a lot of articles are long and boring to read with a lot of useless details.
- croemer 14d ago
  Redacting what? Did you mean write or edit?
  - Skywalker13 14d ago
    "rédiger" in french, then it's "write" instead of "redacting" I suppose.. sorry for my poor english
    - croemer 14d ago
      Thanks, makes sense! No need to be sorry!
    - Timwi 14d ago
      Yeah that's “edit” in English.

sjpb 15d ago

If you're going to rip off xkcd pictures, I feel it'd be polite at least credit and/or link the original.

velcrovan 14d ago
xkcd pics are provided under a Creative Commons Attribution/Non-commercial license, so attribution is required but using them is ok.
- ninju 14d ago
  Yeah but its also quite trivial to give them credit https://xkcd.com/2347/ https://xkcd.com/2347/
deleted 14d ago
[deleted]
Timwi 14d ago
I had the same thought. This is honestly plagiarism.

mitxela 15d ago

FYI all signalling is in-band signalling

ErroneousBosh 14d ago
And all signals are analogue, if you're paying enough attention to the transients ;-)

b800h 14d ago

> "1994" > "RISC was a distant dream" Ahem

dspillett 14d ago
Maybe I'm in a generous mood, but I would credit the writer with making a joke about the content of the film they had just mentioned and subsequently show a screen cap of work the subtitles for a line about RISC being a significant future technology, rather than being that historically inaccurate in their own tech memory.
- b800h 14d ago
  Oh yes, "RISC is going to change everything". I remember that line. Clunky from the author, I think.
richrichardsson 14d ago
Was just coming to comment on that too. "Tell that to the ARM based Acorn Archimedes I was using at 6th Form College in 1991."
- icedchai 14d ago
  Or all the Sun Sparc servers that were incredibly common at that time. Coincidentally, they almost all ran telnet!

johnnyApplePRNG 14d ago

Something tells me the NSA is none too pleased about the advent of LLMs. Or is there a tradeoff? Fewer ancient holes like this for their hackers but wide open access to anyone who installs codex or claude code?

spydum 14d ago
I know people seem to think nsa and other gov threat actors live in a land of zero days and advanced techniques... And to some degree, they sure do develop those and are able to leverage them. However, from my point of view most targets are able to be compromised by poor configs, hygiene, well known and patchable vulns, or the more likely avenue: the humans operating the system.

ErroneousBosh 14d ago

> In fact, this vulnerability was born so long ago (way back in 1994) > That was so long ago that RISC was still a distant dream. Yeah ARM would like to have a word with you. I'd been using RISC on the desktop for about five years by then and I was not an early adopter.

j16sdiz 14d ago
and SPARC was one of the top choice for server where telnet were run.
- fl7305 14d ago
  and the DEC Alpha RISC CPU was on fire, and ran circles around the desktop CISC CPUs
  - ErroneousBosh 14d ago
    I wish I'd never given away my MIPS R2000-based DECStation 3100.

egorfine 14d ago

And this is why serious enterprises use telnetd exclusively instead of your childish ssh toy. See why? Because it's got ONE CVE in 3 decades as compared to a never-ending flow of security vulnerabilities in ssh. Security! /s

e12e 14d ago

Wow, how did this not get discovered and fixed at the time of: https://www.cve.org/CVERecord?id=CVE-2007-0882 https://www.cve.org/CVERecord?id=CVE-2007-0882 Might be a 32 year old bug, but it's practically also a 19 years old exploit? Ed: I'm confusing TFA with https://nvd.nist.gov/vuln/detail/cve-2026-24061 https://nvd.nist.gov/vuln/detail/cve-2026-24061 Which seems pretty much identical with the 2007 cve.

Rooster61 14d ago

The server asks the bug "Why the long face?". The bug, being a bug, proceeds to overflow the buffer

mzs 14d ago

CVE-2026-32746

JdeBP 13d ago

A lot of people have already made almost all of the same observations that I was going to make. Except for: There is no bug that originates in a GNU version of an old networking program and magically makes its way into the NetBSD, FreeBSD, DragonFlyBSD, and OpenBSD (Yes; I checked.) versions of that program. History simply didn't happen that way. This bug goes as far back at least as far as the Jolitz-released 386BSD source for libexec/telnetd , where it can be found and which is credited in the GNU versions of the file. GNU just took the 386BSD code. But BSD had a telnetd before 386BSD. In BSD, telnetd itself goes back to 1983. Although its code to do line mode did not pre-date RFC 1116, which was published in August 1989. The code to do line mode was written the month after that RFC, by Paul Borman, and the bug is in the very first version of that code: * https://github.com/dspinellis/unix-history-repo/blob/dc8d5043207cb2f457f5f15344168c2a8347079d/usr/src/libexec/telnetd/slc.c#L104 https://github.com/dspinellis/unix-history-repo/blob/dc8d504... This bug is not 32 years old.