Unscored severity · published Feb 12, 2007
CVE-2007-0882
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the…
–
CVSS
98.1%
EPSS
No
On KEV
Description
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.
Exploitation
Is it being used?
Exploit prediction (EPSS)98.1% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Solaris · Oracle
10; 11 · source: NVD
SU
Sunos · Sun
5.10; 5.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0882
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0882
Exploit
http://erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.html
Exploit
http://isc.sans.org/diary.html?storyid=2220
Broken Link
http://osvdb.org/31881
Mailing List
http://seclists.org/fulldisclosure/2007/Feb/0217.html
Broken Link
http://secunia.com/advisories/24120
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102802-1
More from Solaris
10.0
CVE-2020-14871
Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
8.8
CVE-2019-3010
Oracle Solaris Privilege Escalation Vulnerability
8.8
CVE-2015-4495
Mozilla Firefox Security Feature Bypass Vulnerability
7.8
CVE-2008-2992
Adobe Reader and Acrobat Input Validation Vulnerability
7.5
CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability