This script is Copyright (C) 2007-2015 Tenable Network Security, Inc.
It is possible to log into the remote system using telnet without
supplying any credentials
The remote version of telnet does not sanitize the user-supplied
'USER' environment variable. By supplying a specially malformed USER
environment variable, an attacker may force the remote telnet server
to believe that the user has already authenticated.
For instance, the following command :
telnet -l '-fbin' target.example.com
will result in obtaining a shell with the privileges of the 'bin'
See also :
Install patches 120068-02 (sparc) or 120069-02 (i386),
which are available from Sun.
Filter incoming to this port or disable the telnet service
and use SSH instead, or use inetadm to mitigate this
problem (see the link below).
Risk factor :
Critical / CVSS Base Score : 10.0
CVSS Temporal Score : 8.7
Public Exploit Available : true
Family: Gain a shell remotely
Nessus Plugin ID: 24323 ()
Bugtraq ID: 22512
CVE ID: CVE-2007-0882
Upgrade to Nessus Professional today!
Start your free Nessus Cloud trial now!
Begin Free Trial
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.