Solaris 10 has zero-day Telnet flaw
Attackers could exploit a zero-day flaw in Solaris 10's Telnet daemon to bypass authentication and gain unauthorized system access, security experts warn.
According to several security organizations, a serious design error has been exposed in the Solaris 10-11 Telnet daemon that allows for unauthenticated remote root logins.
"This vulnerability can be exploited by using standard Telnet commands, further increasing the severity of this exposure," Cupertino, Calif.-based antivirus giant Symantec Corp. warned in an emailed message to customers of its DeepSight threat management service. "An exploit for this issue was released without an associated advisory and therefore it is believed that it has been exploited in the wild prior to the release."
Symantec urged administrators to disable Telnet immediately until Sun fixes the problem.
The French Security Incident Response Team (FrSIRT) has rated the problem high-risk, describing it as an error in the Telnet daemon (in.telnetd) that fails to properly validate authentication information before being passed to the login process.
The Telnet protocol allows virtual network terminals to be connected over the Internet and is incorporated into a variety of popular operating systems, from Sun Solaris and Red Hat Enterprise Linux to Apple's Mac OS X.
Donald Smith, a volunteer handler at the Bethesda, Md.-based SANS Internet Storm Center (ISC), said this latest flaw should serve as a reminder that Telnet is not secure.
"In my opinion nobody should be running telnet open to the Internet," he wrote on the ISC Web site. He noted that since 1994, the CERT Software Engineering Institute at Carnegie Mellon University has recommended using something other than plain text authentication due to potential network monitoring attacks.
The ISC suggested IT administrators mitigate the threat by either disabling Telnet or limiting the number of IP addresses that can connect to Telnet through the firewall.
