NetBSD released an advisory on talkd buffer overflow a day or two ago, check: http://cvsweb.netbsd.org/bsdweb.cgi/basesrc/libexec/talkd/ Quick look at netkit-ntalk code seems to indicate that a similar fix might be necessary here too (also checked 0.18pre). I also pinged the netkit maintainer, no reply at least yet.
The maintainer responded back: --8<-- It appears you may be right. I wonder how that slipped through. However, the data in question comes from utmp. utmp is a trusted file. Lots and *lots* of things are vulnerable if utmp is corrupted. And this one (with a normal configuration) only gets you group tty, which is less useful for hacking than group utmp. This is not to say it shouldn't be fixed, and it will be... thanks for the heads-up. --8<-- If that analysis is correct this is not too grave a problem (who is using talkd anyway??!?!? ;-), and will be fixed in upstream.
Correct. :-) Closing bug because of analysis. :-) Read ya, Phil