Windows Authentication Exposes Telnet

Telnet, the mainstay of remote management for decades, got a feature enhancement in Windows 2000 that might streamline the logon process, but could also expose user authentication credentials to a hacker. Microsoft has recently released a patch that eliminates a security vulnerability in Windows 2000 telnet client. The bug could allow a malicious user to trick an unsuspecting victim into automatically starting a telnet session with the hacker's telnet server, thereby transmitting critical user authentication information to that server. With the help of KeyLabs, BugNet was able to reproduce this bug that affects all Windows 2000 users. The vulnerability occurs because of a new authentication feature added to Windows 2000's telnet.exe. (more...)