Johannes Ullrich from the SANS ISC sent this to me and then I saw it on
the DSHIELD list:
----
If you run Solaris, please check if you got telnet enabled NOW. If you
can, block port 23 at your perimeter. There is a fairly trivial
Solaris telnet 0-day.
telnet -l "-froot" [hostname]
will give you root on many Solaris systems with default installs
We are still testing. Please use our contact form at
https://isc.sans.org/contact.html
if you have any details about the use of this exploit.
----
You mean they still use telnet?!
Update from HD Moore:
"but this bug isnt -froot, its -fanythingbutroot =P"
On the exploits@ mailing list and on DSHIELD this vulnerability was
verified as real.
If Sun doesn't yet block port 23/tcp incoming on their /8, I'd make it a
strong suggestion.
Anyone else running Solaris?
Gadi.
