Solaris 10 Forced Login Telnet Authentication Bypass

This script is Copyright (C) 2007-2015 Tenable Network Security, Inc.

Synopsis :

It is possible to log into the remote system using telnet without
supplying any credentials

Description :

The remote version of telnet does not sanitize the user-supplied
'USER' environment variable. By supplying a specially malformed USER
environment variable, an attacker may force the remote telnet server
to believe that the user has already authenticated.

For instance, the following command :

telnet -l '-fbin'

will result in obtaining a shell with the privileges of the 'bin'

See also :

Solution :

Install patches 120068-02 (sparc) or 120069-02 (i386),
which are available from Sun.

Filter incoming to this port or disable the telnet service
and use SSH instead, or use inetadm to mitigate this
problem (see the link below).

Risk factor :

Critical / CVSS Base Score : 10.0
CVSS Temporal Score : 8.7
Public Exploit Available : true

Family: Gain a shell remotely

Nessus Plugin ID: 24323 ()

Bugtraq ID: 22512

CVE ID: CVE-2007-0882