Sploitus

Exploit for Solaris telnetd authentication bypass

saint Β· 2007-02-16

Exploit Code

MARKDOWN32 lines
## https://sploitus.com/exploit?id=SAINT:D7A17E0FAF80C87E6BDBCA024D9A13C0
Added: 02/16/2007  
CVE: CVE-2007-0882  
BID: 22512  
OSVDB: 31881  


### Background

The Telnet service allows remote users to authenticate to a system and use an interactive command shell. The Telnet service is implemented by the Telnet daemon, `**telnetd**`. 

### Problem

The `**telnetd**` program in Solaris 10 and 11 misinterprets `**USER**` environment variables beginning with "-f", resulting in an authentication bypass vulnerability. A remote attacker could execute arbitrary commands using a standard telnet client program. 

### Resolution

Apply one of the patches referenced in Sun Alert 102802. 

### References

http://secunia.com/advisories/24120   
http://www.kb.cert.org/vuls/id/881872   


### Limitations

Exploit works on Solaris 10 and 11. Root access can only be gained if the target system allows non-console superuser access. 

### Platforms

SunOS