As we already know, vulnerabilities are evolving. In the past, the worst case we could imagine was vulnerability in a service which we run on our own server. After 2000, increasing worm and dDoS trends in the vulnerability market changed our priority to the rest of Internet: Clients.When we remember the worms and dDoS attacks which paralyzed backbones, it’s clear that we expect the worst case from client threats.

The most popular vulnerability of this past week (I ignore MS-patches) seems to be SunOS telnetd. In IRC channels and security forums, people say “Woaaw! Hey! You heard that?” Everybody is talking about this.

Another vulnerability published this week got lost in the SunOS noise: uTorrent.

We could be sure that an administrator in a company which uses SunOS, disabled the telnetd service. If he (or she) really needs telnetd, we could also be sure that he patched the system already, or he didn’t allow connections from the outside (Most companies use Solaris for their Oracle databases and of course these servers are not public). Because of these reasons, I don’t think that the Solaris telnetd vulnerability is worth more discussion.

On the other hand, uTorrent is a widely used “light” torrent client.
It doesn’t have an automatic patching system, most of its users don’t even know what a ‘vulnerability’ is, and most of them also don’t use an anti virus (some of them even disable it to make their computers faster – download files ‘easily’). Even with some of the users who already use anti virus software, the rest of the users, if compromised and made into a botnet, would be enough to make a spectacular attack. The exploit is public and easy to use.
Everyone can upload their own files to any torrent search site (they don’t have any security control).

I’m not sure if this uTorrent vulnerability is going to be used to create a worm, but what I’m sure about is that the uTorrent vulnerability has higher damage-potential than a SunOS telnetd vulnerability.

This week shows us basically our changing priorities and demonstrates the evolution of security over the years.

Burak CIFTER.

References:

1. Solaris telnetd vulnerability:
http://blogs.securiteam.com/index.php/archives/821

2. uTorrent vulnerability:
http://milw0rm.com/exploits/3296
http://www.securiteam.com/exploits/5PP0G0UKKW.html