RE: Solaris telnet vulnberability - how many on your network?
> From: Nate Eldredge [mailto:nge@xxxxxxxxxx]
> Sent: Friday, 16 February, 2007 21:42
>
> On Sat, 17 Feb 2007, Darren Reed wrote:
>
> >
> > Solaris's /bin/login has never supported the "-f" command line
option
> > until Solaris 10 (RTFM) so this exploit was just plain not possible.
>
> That is not correct. On a Solaris 8 box the -f option is accepted
without
> error.
Which does not show that it's "supported". /bin/true accepts the -f
option, too.
> I don't have root so I can't verify that it does the right thing,
You're using a Solaris 8 system with no entry in /etc/passwd for UID 0?
Extraordinary.
> but at least as a normal user "login -f asdfasdf" does nothing
I haven't looked at the Solaris 10 login sources, but IIRC on AIX, this
bug required that the username be appended to the -f ("-froot", not "-f
root").
> while "login" without arguments presents a prompt.
And what does "login -q asdfasdf" do? What about "login -z asdfasdf"?
(I know what they do on a couple of older Solaris boxes I happen to
have, but I'll leave this as an exercise for the reader.)
--
Michael Wojcik
Principal Software Systems Developer, Micro Focus