More telnet Daemon Fun

Aaron Campbell (
Mon, 01 Dec 1997 22:29:21 -0400

Regarding user-supplied terminfo files...

|autopsy!user52810@AZRAEL.DWEEBS.NET| suggested this feature, as found
in the terminfo man page, might be malaciously used in a custom
terminfo file:

-np Number of pages of memory c100-4p

Possibile to crash a machine using this? Anyone?

Thanks to Jason Parsons <> for pointing this one out:

[fx@somehost fx]$ export DISPLAY=""
[fx@somehost fx]$ telnet .
Connected to ..
Escape character is '^]'.

Red Hat Linux release 4.2 (Biltmore)
Kernel 2.0.30 on an i586
telnet> send esc

telnet> quit
Connection closed.
[fx@somehost fx]$ export DISPLAY="1234567890123456789012345678901234567890123
[fx@somehost fx]$ telnet .
Connected to ..
Escape character is '^]'.
Segmentation fault (core dumped)
[fx@somehost fx]$ ls -l core
-rw------- 1 fx nnh 315392 Dec 1 21:51 core
[fx@somehost fx]$

That's 256 characters up there, BTW. Also, note we're setting the DISPLAY
variable this time, not TERM.

Lastly, while doing some testing, I discovered that setting my TERM
variable to a 256-character string under Solaris 2.5.1 caused my bash
shell session to crash, dump core and log me out. This may or may not have
been mentioned on Bugtraq before, and may or may not be due to missing

Pardon my vagueness, but I've been swamped lately and really don't have
much time to explore these problems in more detail.

. _ _ _ _ . . _ _ . . _ _ _ . .
: |-||-||<|_||\| |_|-||\/||-'|->|_-|_|_ Dalhousie University, Halifax, NS
`--------------------------------------------- [fx!] ----