Multiple Vendor System V Derived 'login' Buffer Overflow Vulnerability

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

A publicly available exploit has been written for Solaris i386 systems. An unpublished exploit for Solaris/SPARC systems is in circulation in the underground.

This issue is also exploitable by setting the TTYPROMPT environment variable to contain six bytes of data and then passing a string containing 65 " c" character combinations, followed by a newline, to a telnet service accessing the vulnerable login.

A newer exploit has been made available.


Privacy Statement
Copyright 2010, SecurityFocus