In the summer of 1996 I took over responsibility for the Linux NetKit
package. This is the package that consists of such little-used and
insignificant programs as telnet and finger.
Installing these things had always been a chancy business, all the way
back to the days when there was NET1 and NET2 and you were lucky to
get binaries that ran, much less source that would compile. Florian
LaRoche's NetKit packages did a good job of reigning in that chaos.
Finally there was one single authoritative source for most of the
programs and there was a known place one could go and pick them up.
Unfortunately getting NetKits to compile was a bit of a chore, and
Florian himself disappeared off the net for a while, so by June of
1996 there hadn't been any updates in a good while and various changes
to the kernel and libc made the existing NetKit versions excessively
hard to work with. More importantly, there was at least one
outstanding security problem.
There had been a bunch of NetKits, but only NetKit-A and NetKit-B had
wide distribution. NetKit-A was almost entirely just repackaging of
things maintained by other people, while NetKit-B contained a pile of
modified BSD code that had been maintained by Florian. Since most of
the contents of NetKit-A had been updated separately since NetKit-A
was last released, I simply killed off NetKit-A, and continued with
just NetKit-B.
I released NetKit-B-0.07 in July of 1996, which fixed five security
holes in different programs. One of these (in rlogin) had been known
previously and was part of the motivation for finding the package a
new maintainer. The other four I found myself in the course of
preparing the release. More importantly (at least to some people) the
July NetKit release compiled cleanly out of the box, even with a pile
of gcc warning options enabled.
NetKit-B-0.08 was released in August, fixing more security problems
and catching up on a backlog of changes and patches floating around
the net. In September, for the next release, I decided to drop the now
meaningless "B", and so the next version was simply NetKit-0.09,
although it didn't actually appear until December.
NetKit 0.10 appeared in early 1997, but it doesn't quite exist in that
form. After substantial debate I decided to split the NetKit package
into about a dozen and a half components. These can now all be
downloaded separately. The reasoning is that NetKit was never exactly
*complete* - you needed a bunch of other stuff along with it to get a
full system with network support - and for various reasons it wasn't
ever going to be. So having everything bundled together wasn't
especially meaningful, and if each distinct piece is packaged
separately it's a lot easier to find the one particular thing you're
looking for on an ftp archive. More importantly, the pieces can now be
released and updated separately: there's no need for telnet to hold up
fixes to inetd (like happened with the 0.09 release) so the turnaround
time on security problems should be much lower now.
Versions of NetKit prior to 0.09 should not be used under any circumstances. In general, it is unwise to use anything other than the latest version, which should now be higher than the last (0.10) release I made.
The following security issues appeared while I was maintainer:
(*) One of these, in ntalkd, became the subject of a CERT advisory (CA-97.04) in January 1997. You'll note I'm mentioned by name in the Linux vendor information, which is intentionally inaccurate -- the bug in question was fixed in NetKit-B-0.07, not 0.08, but 0.08 fixes other important bugs and we hoped to get more people to upgrade this way.
The sad part is that the information was public for six months before the CERT advisory appeared and most of the commercial vendors were still caught napping; it only became an issue because somebody posted an exploit script to alt.security. The frightening part is that a similar degree of inattention has been paid to an almost identical bug in telnetd I found and fixed at the same time... and there must be an exploit loose, it's only a minor change to the one for talkd. Be very afraid.
The official site is at ftp.uk.linux.org. Note that things are found in several subdirectories.
You can also get it from sunsite.unc.edu.