EIP-2026-103157

This exploit targets a TCP/IP weakness in Linux kernel 2.2 by spoofing a connection to rlogind (port 513) to inject a command that adds a malicious entry to ~/.rhosts. It uses sequence number prediction and packet sniffing to establish a blind spoofed connection.