TELNET: Solaris /bin/login Buffer Overflow

This signature detects attempts to exploit a known vulnerability against the /bin/login executable that ships with Solaris for SPARC and Intel architectures. Attackers can use a Telnet daemon to exploit /bin/login and execute arbitrary code on the host as root.

Extended Description

The 'login' program is used in UNIX systems to authenticate users with a username and password. The utility is typically invoked at the console, by 'telnetd', 'rlogind', and if configured to do so, SSH. Versions of 'login' descended from System V UNIX contain a buffer overflow when handling environment variables. Several operating systems such as Solaris/SunOS, HP-UX, AIX, IRIX, and Unixware contain vulnerable versions of 'login'. Unauthenticated clients can exploit this issue to execute arbitrary code as root. On systems where 'login' is installed setuid root, local attackers can elevate privileges.

Affected Products

Cisco pgw2200_pstn_gateway,Sco open_server

References

BugTraq: 3681

CVE: CVE-2001-0797

URL: http://www.securityfocus.com/advisories/3727 ftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.40/CSSA-2001-SCO.40.txt http://www.kb.cert.org/vuls/id/569272

Short Name

TELNET:EXPLOIT:SOLARIS-LOGIN-OF

Severity

Critical

Recommended

False

Recommended Action

Drop

TELNET: Solaris /bin/login Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?