Hacker News Reader

It has been a very long time since I have seen a news article on the browser vs. browser security wars. That is a good thing. Competitions like this do the world a service by demonstrating that there is not, and in all probability never will be any such thing as a browser that is truly secure. Well - maybe "telnet {$addr} 80".

View on HN

maybe "telnet {$addr} 80".

Summary: The Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote Telnet servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, aka "Telnet Credential Reflection Vulnerability," a related issue to CVE-2000-0834. Published: 08/12/2009

or maybe not ;-)

I'm pretty sure "The Telnet service" refers to the telnet server, not the telnet command (client). It does seem feasible that you could overflow a buffer or affect the terminal window by causing telnet to output special control characters, etc. of course.

Reply on news.ycombinator.com