This version of talkd, borrowed from the FreeBSD 2.2 sources,
plugs that hole.
The quad-fat binary is here, along with the source code.
If you want to compile it yourself, you FIRST need to get the patched Syslog() from
(which includes a quad-fat library) or from
which is where this package originated.
Compiling this package yields a library, libnewlog.a, containing a version of syslog(3) which is immune to the infamous buffer-overflow bug (CERT Advisory CA-95.13), as well as a bunch of other BSD4.4ish goodies which are necessary to compile this version of talkd.
Install the library in /usr/local/lib:
% cp libnewlog.a /usr/local/lib
% chmod 644 /usr/local/lib/libnewlog.a
% ranlib /usr/local/lib/libnewlog.a
Now you are ready to compile talkd. Simply type "make".
When installing it, note that you need to replace BOTH /usr/etc/talkd and /usr/etc/ntalkd with the talkd binary that you produce. (If you don't want to overwrite them, you can simply change their permissions to 600, and edit /etc/inetd.conf to point to the location of the new binary. Be sure to kill -HUP the inetd daemon to get it to reread its configuration file.)
Even if you do install the replacement talkd daemon, do consider installing BIND 8 and running a caching-only nameserver. This will protect your other programs from rogue data returned by gethostbyname() and gethostbyaddress(). Setting up a caching-only nameserver is easy; details can be found at the BIND web site.
That's it. Enjoy. . .