How to solve the telnet Vulnerability (1)

The telnet Vulnerability has always been our concern. How can this problem be solved? Next we will sort out and share the articles of a netizen. I hope to discuss this issue with you here. For more information, see the following section.

Early versions of Solaris 2.6, 7, and 8 have a telnetd Vulnerability. You can bypass the verification using the environment variable TTYPROMPT of/bin/login. As a result, you can log on without authentication. Recently, telnet on Solaris 10 was found to have a vulnerability, and Sun also released a patch in time.

Let's first look at the symptoms of the problem. The system environment where the vulnerability occurs is Solaris 10 or later. The default installation is not selected during installation. The vulnerability occurs when you specify any "-fusername" parameter after the-l option of the Solaris telnet command, you can directly log on to the Solaris system.

Command Format:

 
 

  
  
telnet -l "-fbin" target_address 
 
 

The following is a demonstration of using the telnet Vulnerability to log on to the system as a bin user.

 
 

  
  
# telnet -l "-fbin" myhost  
  
  
Trying 172.21.60.120...  
  
  
Connected to myhost.  
  
  
Escape character is '^]'.  
  
  
Sun Microsystems Inc.　 SunOS 5.10　Generic January 2005  
  
  
$ id -a  
  
  
uid=2(bin) gid=2(bin) groups=2(bin),3(sys) 
 
 

If the Administrator modifies the/etc/default/login file and comment out the CONSOLE line to allow root remote logon, the visitor can use this vulnerability to directly log on to the system as root, this poses greater harm to the system.

Kingsley first provided the source code of the vulnerability found in OpenSolaris and called it a "0-day"-zero-day vulnerability. Article address: http://www.com-winner.com/0day_was_the_case_that_they_gave_me.pdf

A script is provided in this Article. After running the script, the user can obtain the adm user permission of the logged-on system.

Solution:

1. disable the telnet service for Solaris 10.

Check whether the local telnet service is enabled.

 
 

  
  
# svccfg list | grep telnet  
  
  
network/telnet  
  
  
# svcs -l network/telnet  
  
  
fmri svc:/network/telnet:default  
  
  
name Telnet server  
  
  
enabled　true  
  
  
stateonline  
  
  
next_state　 none  
  
  
state_time　 Mon Feb 26 03:50:13 2007  
  
  
restartersvc:/network/inetd:default 
 
 

Disable the telnet service.

 
 

  
  
# svcadm disable svc:/network/telnet:default 
 
 

2. download and install the Sun Security Patch, which must be supported by the Sun service ).