Bugtraq: RE: Solaris telnet vulnberability - how many on your network?

["Michael Wojcik" <Michael.Wojcik () microfocus com>]

> From: Nate Eldredge [mailto:nge () cs hmc edu] 
> Sent: Friday, 16 February, 2007 21:42
>
> On Sat, 17 Feb 2007, Darren Reed wrote:
>
> > Solaris's /bin/login has never supported the "-f" command line
option
> > until Solaris 10 (RTFM) so this exploit was just plain not possible.
> That is not correct.  On a Solaris 8 box the -f option is accepted
without 
> error.
Which does not show that it's "supported".  /bin/true accepts the -f
option, too.

> I don't have root so I can't verify that it does the right thing,
You're using a Solaris 8 system with no entry in /etc/passwd for UID 0?
Extraordinary.
 
> but at least as a normal user "login -f asdfasdf" does nothing
I haven't looked at the Solaris 10 login sources, but IIRC on AIX, this
bug required that the username be appended to the -f ("-froot", not "-f
root").

> while "login" without arguments presents a prompt.
And what does "login -q asdfasdf" do?  What about "login -z asdfasdf"?

(I know what they do on a couple of older Solaris boxes I happen to
have, but I'll leave this as an exercise for the reader.)

-- 
Michael Wojcik
Principal Software Systems Developer, Micro Focus