National Cyber-Alert System

Vulnerability Summary for CVE-2007-0882

Overview

Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-059A

Name: TA07-059A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-059A.html

US-CERT Vulnerability Note: VU#881872

Name: VU#881872

Hyperlink:http://www.kb.cert.org/vuls/id/881872

External Source: XF

Name: solaris-telnet-authentication-bypass(32434)

Hyperlink:http://xforce.iss.net/xforce/xfdb/32434

External Source: SECTRACK

Name: 1017625

Hyperlink:http://www.securitytracker.com/id?1017625

External Source: BID

Name: 22512

Hyperlink:http://www.securityfocus.com/bid/22512

External Source: BUGTRAQ

Name: 20070214 RE: [Full-disclosure] Solaris telnet vulnberability - how many onyour network?

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/460103/100/100/threaded

External Source: BUGTRAQ

Name: 20070214 Solaris telnet vuln solutions digest and network risks

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/460086/100/100/threaded

External Source: BUGTRAQ

Name: 20070213 Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/459980/100/0/threaded

External Source: BUGTRAQ

Name: 20070212 Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/459855/100/0/threaded

External Source: BUGTRAQ

Name: 20070212 Solaris telnet vulnberability - how many on your network?

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/459843/100/0/threaded

External Source: BUGTRAQ

Name: 20070212 Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network?

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/459831/100/0/threaded

External Source: MILW0RM

Name: 3293

Hyperlink:http://www.milw0rm.com/exploits/3293

External Source: VUPEN

Name: ADV-2007-0560

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2007/0560

External Source: SUNALERT

Name: 102802

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102802-1

External Source: SECUNIA

Name: 24120

Type: Advisory

Hyperlink:http://secunia.com/advisories/24120

External Source: FULLDISC

Name: 20070211 "0day was the case that they gave me"

Hyperlink:http://seclists.org/fulldisclosure/2007/Feb/0217.html

External Source: OSVDB

Name: 31881

Hyperlink:http://osvdb.org/31881

External Source: MILW0RM

Name: 3293

Hyperlink:http://milw0rm.com/exploits/3293

External Source: MISC

Name: http://isc.sans.org/diary.html?storyid=2220

Hyperlink:http://isc.sans.org/diary.html?storyid=2220

External Source: MISC

Name: http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.html

Hyperlink:http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.html

US Government Resource: oval:org.mitre.oval:def:2202

Name: oval:org.mitre.oval:def:2202

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2202