CVE-2007-0882: oracle solaris Argument Injection

CVSS: 10.0v2.0HighModified

Published 12-02-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-0882 is a high (CVSS 10.0) Argument Injection vulnerability in oracle solaris. EPSS estimates a 98.06% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 6 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

98.06%

0%100%

Critical · +0.04 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits6reference, metasploit, exploit-database

Timeline

12-02-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

98.06%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.04 pp

From 98.01% on 21-09-2026

21-09-202621-10-2026

EPSS score

98.06%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

6 found

referenceUnverified
Exploit Reference (erratasec.blogspot.com)
Maturity: unknown
referenceUnverified
Exploit Reference (isc.sans.org)
Maturity: unknown
MetasploitremoteVerified
Sun Solaris Telnet Remote Authentication Bypass Vulnerability
exploit/solaris/telnet/fuser
Maturity: weaponized

Show all 6 exploits

exploit-databaseremotesolarisVerified
Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit)
Maturity: weaponized
exploit-databaseremotesolarisVerified
Sun Solaris Telnet - Remote Authentication Bypass (Metasploit)
Maturity: weaponized
exploit-databaseremotesolarisVerified
SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Oracle1 product

solarisEOL10 | 11

Sun1 product

sunos5.10 | 5.11

2 vendors · 2 products

References

19 links

www.securityfocus.com/archive/1/459843/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2007/0560VDB EntryX Refsource VUPENBroken LinkVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/32434VDB EntryX Refsource XFThird Party Advisory
www.kb.cert.org/vuls/id/881872Third Party AdvisoryX Refsource CERT VNUS Government Resource
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2202VDB EntrySignatureX Refsource OVALBroken Link
erratasec.blogspot.com/2007/02/trivial-remote-solaris-0day-disable.htmlX Refsource MISCExploitThird Party Advisory
www.securityfocus.com/archive/1/460086/100/100/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/24120Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
seclists.org/fulldisclosure/2007/Feb/0217.htmlMailing ListX Refsource FULLDISCThird Party Advisory
www.securitytracker.com/id?1017625VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory

Show all 19 references

isc.sans.org/diary.html?storyid=2220X Refsource MISCExploitThird Party Advisory
sunsolve.sun.com/search/document.do?assetkey=1-26-102802-1Vendor AdvisoryX Refsource SUNALERTBroken Link
osvdb.org/31881VDB EntryX Refsource OSVDBBroken Link
www.securityfocus.com/bid/22512VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.securityfocus.com/archive/1/459831/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.securityfocus.com/archive/1/460103/100/100/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.securityfocus.com/archive/1/459980/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.us-cert.gov/cas/techalerts/TA07-059A.htmlThird Party AdvisoryX Refsource CERTBroken LinkUS Government Resource
www.securityfocus.com/archive/1/459855/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities