CVE-2007-0882
Solaris 10 and 11 - Unauthenticated Argument Injection in telnetd via -f Sequence
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2007-0882.
PoCs published by Metasploit, MC, kingcope, including Metasploit module exploits/solaris/telnet/fuser.
AI-analyzed exploit summary This Metasploit module exploits an argument injection vulnerability in Solaris 10/11 telnet daemon (in.telnetd) to bypass authentication and execute arbitrary commands. It manipulates telnet protocol negotiations to set environment variables and inject a payload.
Description
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.
Exploits (4)
This Metasploit module exploits an argument injection vulnerability in Solaris 10/11 telnet daemon (in.telnetd) to bypass authentication and execute arbitrary commands. It manipulates telnet protocol negotiations to set environment variables and inject a payload.
This exploit leverages an argument injection vulnerability in Sun Solaris telnet daemon (in.telnetd) to bypass authentication and execute arbitrary commands. It manipulates telnet protocol negotiations to set environment variables and inject a payload.
This exploit leverages a vulnerability in SunOS 5.10/5.11 in.telnetd by injecting a malformed username (-f<account>) to bypass authentication and gain remote access. The script automates the telnet command with the crafted payload.
This Metasploit module exploits an argument injection vulnerability in Solaris telnetd (CVE-2007-0882) to bypass authentication and execute arbitrary commands. It manipulates telnet protocol negotiations to set environment variables and inject a payload.