Quantum Secular Labs / Blog / Advisories

CVE-2007-0882: Oracle Solaris: Improper Neutralization of Argument Delimiters in a Command

CVE-2007-0882 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Oracle Solaris. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

Access vector: Network. Exploitable remotely over the network.
Access complexity: Low. No special conditions are required.
Authentication: None. No authentication is needed.
Confidentiality impact: Complete. Total information disclosure.
Integrity impact: Complete. Total loss of integrity.
Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-88: Improper Neutralization of Argument Delimiters in a Command

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected products

Oracle Solaris: 10; 11
Sunos: 5.10; 5.11