CVE-2007-0882 Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to ski...
HighCVSS 10.0
EPSS 98.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle solaris | = 10 | No fix listed |
| oracle solaris | = 11 | No fix listed |
| sunos | = 5.10 | No fix listed |
| sunos | = 5.11 | No fix listed |
References
- erratasec.blogspot.com exploit third-party-advisory
- isc.sans.org exploit third-party-advisory
- 31881 broken-link vdb-entry
- 20070211 "0day was the case that they gave me" mailing-list third-party-advisory
- 24120 broken-link third-party-advisory vendor-advisory
- 102802 broken-link vendor-advisory
- VU#881872 third-party-advisory us-government-resource
- 20070212 Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network? broken-link mailing-list third-party-advisory vdb-entry
- 20070212 Solaris telnet vulnberability - how many on your network? broken-link mailing-list third-party-advisory vdb-entry
- 20070212 Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? broken-link mailing-list third-party-advisory vdb-entry
- 20070213 Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? broken-link mailing-list third-party-advisory vdb-entry
- 20070214 Solaris telnet vuln solutions digest and network risks broken-link mailing-list third-party-advisory vdb-entry
- 20070214 RE: [Full-disclosure] Solaris telnet vulnberability - how many onyour network? broken-link mailing-list third-party-advisory vdb-entry
- 22512 broken-link third-party-advisory vdb-entry
- 1017625 broken-link third-party-advisory vdb-entry
- TA07-059A broken-link third-party-advisory us-government-resource
- ADV-2007-0560 broken-link vdb-entry vendor-advisory
- solaris-telnet-authentication-bypass(32434) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:2202 broken-link signature vdb-entry