Linked by Thom Holwerda on Mon 12th Feb 2007 18:30 UTC, submitted by stare
If you've got Solaris with telnet running, you could be in for a big surprise. There is a fairly trivial Solaris telnet 0-day exploit in the wild [.pdf]. "This was posted to Full-Disclosure. Remote root exploit in the Solaris 10/11 telnet daemon. It doesn't require any skill, any exploit knowledge, and can be scripted for mass attacks. Basically if you pass a '-fusername' as an argument to the l option you get full access to the OS as the user specified. In my example I do it as bin but it worked for regular users, just not for root. This combined with a reliable local privilege escalation exploit would be devastating. Expect mass scanning and possibly the widespread exploitation of this vulnerability."
Thread beginning with comment 211858
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: This is not an Exploit
by fsckit on Mon 12th Feb 2007 19:51
in reply to "RE: This is not an Exploit"
Member since:2006-09-24
RE[3]: This is not an Exploit
by stare on Mon 12th Feb 2007 20:41
in reply to "RE[2]: This is not an Exploit"
Member since:2005-07-06
RE[2]: This is not an Exploit
by Priest on Tue 13th Feb 2007 09:31
in reply to "RE: This is not an Exploit"
Member since:2006-05-12
RE[3]: This is not an Exploit
by jziegler on Tue 13th Feb 2007 13:05
in reply to "RE[2]: This is not an Exploit"
Member since:2005-07-14
Yes, it is. If you install S10, S10u1 or S10u2, the "full install", in.telnetd is running. Only in the latest release, S10u3, you have the option to install it "secure by default". In that case, the only internet-listening daemon is sshd. All other are either stopped, or are listening on 127.0.0.1 only.
Member since:
2005-07-06
Plain simple, although it's a serious BUG on the telnet daemon service, I won't consider it as an "EXPLOIT".
Well, this bug will be exploited :-)
Third, why use Telnet on the wild?
Telnetd is enabled by default on Solaris 10.