[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <11352F9641010A418AD5057945A3A6598B3F52@MTV-EXCHANGE.microfocus.com>
Date: Mon, 19 Feb 2007 08:27:51 -0800
From: "Michael Wojcik" <Michael.Wojcik@...rofocus.com>
To: <bugtraq@...urityfocus.com>
Cc: "Nate Eldredge" <nge@...hmc.edu>
Subject: RE: Solaris telnet vulnberability - how many on your network?
> From: Nate Eldredge [mailto:nge@...hmc.edu]
> Sent: Friday, 16 February, 2007 21:42
>
> On Sat, 17 Feb 2007, Darren Reed wrote:
>
> >
> > Solaris's /bin/login has never supported the "-f" command line
option
> > until Solaris 10 (RTFM) so this exploit was just plain not possible.
>
> That is not correct. On a Solaris 8 box the -f option is accepted
without
> error.
Which does not show that it's "supported". /bin/true accepts the -f
option, too.
> I don't have root so I can't verify that it does the right thing,
You're using a Solaris 8 system with no entry in /etc/passwd for UID 0?
Extraordinary.
> but at least as a normal user "login -f asdfasdf" does nothing
I haven't looked at the Solaris 10 login sources, but IIRC on AIX, this
bug required that the username be appended to the -f ("-froot", not "-f
root").
> while "login" without arguments presents a prompt.
And what does "login -q asdfasdf" do? What about "login -z asdfasdf"?
(I know what they do on a couple of older Solaris boxes I happen to
have, but I'll leave this as an exercise for the reader.)
--
Michael Wojcik
Principal Software Systems Developer, Micro Focus
Powered by blists - more mailing lists