Hacker News Reader

Comment by 6stringmerc | Hacker News Reader

ArsTechnica article as of this posting:

>Cisco Systems said that more than 300 models of switches it sells contain a critical vulnerability that allows the CIA to use a simple command to remotely execute malicious code that takes full control of the devices. There currently is no fix.

Text on Cisco Support Site linked on ArsTechnica:

>This vulnerability affects the following Cisco devices when running a vulnerable Cisco IOS software release and configured to accept incoming Telnet connections: [Models list]

Put aside for a moment the 'desireability' of the outcome, but from what I gather on Cisco's site, by turning off incoming Telnet connections, the vulnerability can be fixed. I'm rather confused about this.

View on HN

Disabling the service is a way to protect you from the vulnerability, but it is not a fix for the vulnerability. A fix for the vulnerability would allow you to continue using the service.

Right? We have issued a fix for the router - simply unplug all network cables from the router, and you are no longer vulnerable.

The article kind of makes it sound like telnet is somehow necessary and that disabling it hasn't been a best practice for years.

Maybe there are still old devices that don't support SSH and you literally have no option, but really, what other reason is there to have telnet enabled?

That's what I was thinking about. On the Cisco support site Telnet gets barely a mention. It is apparently not the flagship feature of these switches and whatnot. Okay maybe it's customary to leave it open but there's a lot of lazy practices that result in bad security, not just headline "vulnerabilities" that affect - gasp - 300+ models!

So, basically I think Ars Technica's sub-par quality strikes again, in that a tech site gets a fundamental understanding of technology wrong. If something isn't mission critical, can be turned off, and alleviates a vulnerability, then that's a way to fix it. Plain fucking English.

No, that is a workaround. Telnet is still broken until they patch the security hole.

Please, use an RPi attached to a serial port and SSH through it.

Heh, telnet. Reminds me of:

http://m.slashdot.org/story/80056

"(...) vulnerability in Solaris 10 and 11 telnet that allows anyone to remotely connect as any account, including root, without authentication. Remote access can be gained with nothing more than a telnet client. More information and a Snort signature can be found at riosec.com. Worse, this is almost identical to a bug in AIX and Linux rlogin from way back in 1994." February of 2007

i wonder, is it that century old regex bug?

Reply on news.ycombinator.com