| Vulnerability Name: | CVE-2007-0882 (CCN-32434) | ||||||||
| Assigned: | 2007-02-10 | ||||||||
| Published: | 2007-02-10 | ||||||||
| Updated: | 2018-10-30 | ||||||||
| Summary: | Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account. | ||||||||
| CVSS v3 Severity: | 9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C) 8.3 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
6.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-94 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: Full-Disclosure Mailing List, Sat Feb 10 2007 - 22:59:56 CST "0day was the case that they gave me" Source: CCN Type: Full-Disclosure Mailing List, Mon Feb 12 2007 - 16:05:05 CST Solaris telnet vulnberability - how many on your network? Source: CCN Type: Security Sun Alert Feed, 28 Feb 2007 Solaris in.telnetd worm seen in the wild + inoculation script Source: MITRE Type: CNA CVE-2007-0882 Source: MISC Type: UNKNOWN http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.html Source: MISC Type: UNKNOWN http://isc.sans.org/diary.html?storyid=2220 Source: OSVDB Type: UNKNOWN 31881 Source: FULLDISC Type: UNKNOWN 20070211 "0day was the case that they gave me" Source: CCN Type: SA24120 Sun Solaris "in.telnetd" Authentication Bypass Source: SECUNIA Type: Vendor Advisory 24120 Source: CCN Type: SECTRACK ID: 1017625 Solaris in.telnetd Grants Access to Remote Users Source: CCN Type: Sun Alert ID: 102802 Security Vulnerability in the in.telnetd(1M) Daemon May Allow Unauthorized Remote Users to Gain Access to a Solaris Host Source: SUNALERT Type: UNKNOWN 102802 Source: CCN Type: ASA-2007-062 Security Vulnerability in the in.telnetd(1M) Daemon May Allow Unauthorized Remote Users to Gain Access to a Solaris Host Source: CCN Type: US-CERT VU#881872 Sun Solaris telnet authentication bypass vulnerability Source: CERT-VN Type: US Government Resource VU#881872 Source: CCN Type: OSVDB ID: 31881 Solaris Forced Login in.telnetd Authentication Bypass Source: CCN Type: OSVDB ID: 34106 MIT Kerberos telnet Crafted Username Remote Authentication Bypass Source: BUGTRAQ Type: UNKNOWN 20070212 Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network? Source: BUGTRAQ Type: UNKNOWN 20070212 Solaris telnet vulnberability - how many on your network? Source: BUGTRAQ Type: UNKNOWN 20070212 Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? Source: BUGTRAQ Type: UNKNOWN 20070213 Re: [BLACKLIST] [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork? Source: BUGTRAQ Type: UNKNOWN 20070214 Solaris telnet vuln solutions digest and network risks Source: BUGTRAQ Type: UNKNOWN 20070214 RE: [Full-disclosure] Solaris telnet vulnberability - how many onyour network? Source: BID Type: UNKNOWN 22512 Source: CCN Type: BID-22512 Sun Solaris Telnet Remote Authentication Bypass Vulnerability Source: SECTRACK Type: UNKNOWN 1017625 Source: CCN Type: Sun Microsystems, Inc. Web site Sun Microsystems Source: CCN Type: US-CERT Technical Cyber Security Alert TA07-059A Sun Solaris Telnet Worm Source: CERT Type: US Government Resource TA07-059A Source: VUPEN Type: Vendor Advisory ADV-2007-0560 Source: XF Type: UNKNOWN solaris-telnet-authentication-bypass(32434) Source: XF Type: UNKNOWN solaris-telnet-authentication-bypass(32434) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:2202 Source: CCN Type: Rapid7 Vulnerability and Exploit Database [02-12-2007] Sun Solaris Telnet Remote Authentication Bypass Vulnerability | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||