zeek October 2002

zeek@lists.zeek.org

3 participants
5 discussions

by Wang Shaofu

>If you mean the source code for a Telnet server or client, you can find those in >*BSD or Linux sources. Thanks alot I got it by : rpm -i telnet*.src.rpm Have a nice day. Ciao Cloud _________________________________________________________________ 享用世界上最大的电子邮件系统― MSN Hotmail。 http://www.hotmail.com

19 years, 3 months

Re: about Telnet

by Vern Paxson

> Could you tell me where to get tht source code of Telnet? I'm not sure what you mean. Bro's Telnet analyzer is in Telnet.cc, not surprisingly. (It builts on Login.cc.) If you mean the source code for a Telnet server or client, you can find those in *BSD or Linux sources. Vern

19 years, 3 months

about Telnet

by Wang Shaofu

Hi Could you tell me where to get tht source code of Telnet? Thank you very much Have a nice day Ciao Cloud _________________________________________________________________ Chat with friends online, try MSN Messenger: http://messenger.msn.com/lccn/

19 years, 3 months

patch to Bro to detect the newly announced Solaris Telnet remote exploit

by Vern Paxson

The following patch creates a new event, login_prompt, which you can then examine in your policy script. The "right" approach would be to modify Bro to send up the entire Telnet environment, since it's already extracting $DISPLAY and $TERM as well as now $TTYPROMPT; but for expediency I just added $TTYPROMPT as a separate event, similar to the other two. This will be incorporated in the next "current" release. Vern *** Login.cc 2002/09/15 16:14:31 1.11 --- Login.cc 2002/10/03 00:13:16 *************** *** 348,353 **** --- 348,363 ---- mgr.QueueEvent(login_display, vl); } + + else if ( login_prompt && streq(name, "TTYPROMPT") ) + { + val_list* vl = new val_list; + + vl->append(BuildConnVal()); + vl->append(new StringVal(val)); + + mgr.QueueEvent(login_prompt, vl); + } } delete name; *** NetVar.h 2002/10/01 23:45:17 1.68 --- NetVar.h 2002/10/03 00:13:46 *************** *** 134,139 **** --- 134,140 ---- extern Func* login_confused_text; extern Func* login_terminal; extern Func* login_display; + extern Func* login_prompt; extern Func* excessive_line; extern Func* authentication_accepted; *** NetVar.cc 2002/10/01 23:45:17 1.72 --- NetVar.cc 2002/10/03 00:13:54 *************** *** 130,135 **** --- 130,136 ---- Func* login_confused_text; Func* login_terminal; Func* login_display; + Func* login_prompt; Func* excessive_line; Func* authentication_accepted; *************** *** 393,398 **** --- 394,400 ---- login_confused_text = internal_func("login_confused_text"); login_terminal = internal_func("login_terminal"); login_display = internal_func("login_display"); + login_prompt = internal_func("login_prompt"); excessive_line = internal_func("excessive_line"); authentication_accepted = internal_func("authentication_accepted"); *** bro.init 2002/10/01 23:38:16 1.127 --- bro.init 2002/10/03 00:13:28 *************** *** 573,578 **** --- 573,579 ---- global login_confused_text: event(c: connection, line: string); global login_terminal: event(c: connection, terminal: string); global login_display: event(c: connection, display: string); + global login_prompt: event(c: connection, prompt: string); global excessive_line: event(c: connection); global authentication_accepted: event(name: string, c: connection); *** login.bro 2002/09/23 22:23:01 1.26 --- login.bro 2002/10/03 00:17:39 *************** *** 407,412 **** --- 407,418 ---- hot_login(c, fmt("%s term %s", id_string(c$id), terminal), "trb"); } + event login_prompt(c: connection, prompt: string) + { + # Could check length >= 6, per Solaris exploit ... + hot_login(c, fmt("%s $TTYPROMPT %s", id_string(c$id), prompt), "trb"); + } + event excessive_line(c: connection) { if ( is_login_conn(c) )

19 years, 3 months

new mailing list for Bro developers

by Vern Paxson

There's now a new mailing list, bro-devel(a)lbl.gov, for announcements of new "current" Bro release snapshots, and for discussing Bro development and portability issues. If you want to sub-scribe to it, send email to majordomo(a)lbl.gov with "sub-scribe bro-devel" in the message body (*except* remove the '-' from sub-scribe, which I only put in there because otherwise *this* message will be auto-bounced by majordomo's overly protective filtering!). The main bro(a)lbl.gov list remains for discussing general Bro issues/problems/ questions, and for announcements of major ("stable") releases. Also, there will soon be a Bro home page that will include the current "To Do" list of projects, in case you want to tackle one. Vern

19 years, 3 months

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

zeek October 2002