yay for CERT (Score 2, Informative)

It does make me wonder why the people at CERT don't ever pretend to be skript kiddies. I just found this little tid-bit on a well known site which serves a lot of exploits.

Description: A "feature" of most telnetd programs is that they will pass environmental variables (like TERM, DISPLAY, etc) for you. Unfortunately this can be a problem if someone passes LD_PRELOAD and causes /bin/login to load trojan libraries!

Author: Well known, squidge ([e-mail]) wrote this, but I doubt you can reach him. Isn't he in jail now?

Compromise: root REMOTELY!

Vulnerable Systems: Older Linux boxes, I think SunOS systems, probably others.

Date: January 1996 maybe? Quite old but lives forever like phf.