CVE-2007-0882: Code Injection
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0882?
CVE-2007-0882 is considered a critical vulnerability due to its potential to allow unauthorized access to user accounts.
How do I fix CVE-2007-0882?
To fix CVE-2007-0882, update the telnet daemon by applying the latest security patches provided by Oracle.
Which systems are affected by CVE-2007-0882?
CVE-2007-0882 affects Solaris 10 and 11, specifically the telnet daemon on both SPARC and x86 architectures.
What type of attack does CVE-2007-0882 facilitate?
CVE-2007-0882 facilitates remote authentication bypass attacks allowing attackers to log into systems without proper credentials.
Is CVE-2007-0882 exploitable remotely?
Yes, CVE-2007-0882 can be exploited remotely by any attacker with network access to the vulnerable telnet service.