CVE-2001-0797
published 2001-12-12CVE-2001-0797: Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments…
PriorityP271critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
94.92%
99.9th percentile
Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
Affected
62 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| ibm | aix | — | — |
| sco | openserver | — | — |
| sco | openserver | — | — |
| sco | openserver | — | — |
| sco | openserver | — | — |
| sco | openserver | — | — |
| sco | openserver | — | — |
| sco | openserver | — | — |
| sco | openserver | — | — |
| sgi | irix | — | — |
| sgi | irix | — | — |
| sgi | irix | — | — |
| sgi | irix | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
ff fc 18 ff fc 1f ff fc 21 ff fc 23 ff fb 22 ff fc 24 ff fb 27 ff fb 00 ff fa 27 00 00 54 54 59 50 52 4f 4d 50 54 01
bytes↗
ff fd 03 ff fb 18 ff fb 1f ff fb 20 ff fb 21 ff fb 22 ff fb 27 ff fd 05 ff fb 23
bytes↗
94 10 20 00 21 0b d8 9a a0 14 21 6e 23 0b cb dc a2 14 63 68 d4 23 bf fc e2 23 bf f8 e0 23 bf f4 90 23 a0 0c d4 23 bf f0 d0 23 bf ec 92 23 a0 14 82 10 20 3b 91 d0 20 08 82 10 20 01 91 d0 20 08
bytes↗
eb 1d 5e 33 c0 50
- →Detect telnet login attempts supplying the TTYPROMPT environment variable (IAC SB ENVIRON / NEW-ENVIRON option 0x27) with a 6-character value — this is the authentication-bypass trigger for CVE-2001-0797 on Solaris telnetd. ↗
- →Alert on telnet sessions to port 23 where the login username field is followed by 64 or more space-separated single-character arguments (e.g., 'bin c c c c … \n'), indicating the many-arguments buffer overflow trigger. ↗
- →Detect the TESO 7350963 exploit's characteristic telnet negotiation byte sequence (send_data_1) at session start: ff fd 03 ff fb 18 ff fb 1f ff fb 20 ff fb 21 ff fb 22 ff fb 27 ff fd 05 ff fb 23. ↗
- →Monitor /etc/passwd for the addition of a passwordless account entry matching the pattern 'met::463:1::/:/bin/sh', which is the backdoor account written by the TESO exploit shellcode. ↗
- →Flag telnet sessions where the Metasploit TTYPROMPT module's negotiation sequence is observed: IAC WONT TTYPE (ff fc 18), followed by IAC WONT NAWS (ff fc 1f), IAC WONT RSPEED (ff fc 21), IAC WONT ENVOPT (ff fc 23), IAC WILL XDISPLOC (ff fb 22), IAC WONT NEWENV (ff fc 24), IAC WILL ENVIRON (ff fb 27), IAC WILL BINARY (ff fb 00), IAC SB ENVIRON (ff fa 27 00 00) with 'TTYPROMPT' followed by delimiter 0x01 and 6 alphanumeric bytes. ↗
- →The vulnerability is triggered via telnet and rlogin services by passing a large number of arguments to /bin/login; monitor for abnormally large login argument counts on these services. ↗
- →The Metasploit manyargs exploit targets the 'bin' user account as the login name; alert on successful logins as 'bin' from remote telnet/dialup sessions, especially on Solaris 2.6–8. ↗
- ·The TTYPROMPT bypass requires exactly a 6-character value; shorter or longer values may not trigger the authentication bypass integer overflow. ↗
- ·The TTYPROMPT authentication bypass works for any account except root unless remote root login is explicitly permitted on the target. ↗
- ·The Metasploit manyargs exploit (exploit/solaris/dialup/manyargs) targets Solaris 2.6–8 SPARC via dialup modem, not directly over a network TCP connection; the return address 0x00027184 and NOP/shellcode are SPARC-specific. ↗
- ·The TESO 7350963 exploit has separate code paths for X86 and SPARC (controlled by #define X86_FULL_PACKAGE), with different hardcoded GOT/shellcode addresses for each architecture. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rx82-m2fx-fwf6: Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of argum
ghsa_unreviewed·2022-05-03
CVE-2001-0797 [HIGH] GHSA-rx82-m2fx-fwf6: Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of argum
Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
GHSA
GHSA-5vwx-44rv-q6c2: Unknown vulnerability in SGI IRIX 6
ghsa_unreviewed·2022-05-03·CVSS 7.2
CVE-2003-0574 [HIGH] GHSA-5vwx-44rv-q6c2: Unknown vulnerability in SGI IRIX 6
Unknown vulnerability in SGI IRIX 6.5.x through 6.5.20, and possibly earlier versions, allows local users to cause a core dump in scheme and possibly gain privileges via certain environment variables, a different vulnerability than CVE-2001-0797 and CVE-1999-0028.
VulnCheck
sgi irix Out-of-bounds Write
vulncheck·2001·CVSS 10.0
CVE-2001-0797 [CRITICAL] sgi irix Out-of-bounds Write
sgi irix Out-of-bounds Write
Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
Affected: sgi irix
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments
Exploit PoC: https://vulncheck.com/xdb/7a941421b0e5
Cisco
Solaris /bin/login Vulnerability
vendor_cisco·2002-04-10
CVE-2001-0797 CWE-119 Solaris /bin/login Vulnerability
Solaris /bin/login Vulnerability
This advisory describes a vulnerability that affects Cisco products and
applications that are installed on the Solaris operating system, and is based
on the vulnerability of an common service within the Solaris operating system,
not due to a defect of the Cisco product or application. A vulnerability in the
"/bin/login" program was discovered that enables an attacker to execute
arbitrary code under Solaris OS. This vulnerability was discovered and publicly
announced by Internet Security Systems Inc. All Cisco products and applications
that are installed on Solaris OS are considered vulnerable to the underlying
operating system vulnerability, unless steps have been taken to disable access
services such as "bin/login."
We are investigating other Solaris-base
Cisco
Solaris /bin/login Vulnerability
vendor_cisco
CVE-2001-0797 Solaris /bin/login Vulnerability
CVE-2001-0797: Solaris /bin/login Vulnerability
This advisory describes a vulnerability that affects Cisco products and applications that are installed on the Solaris operating system, and is based on the vulnerability of an common service within the Solaris operating system, not due to a defect of the Cisco product or application. A vulnerability in the "/bin/login" program was discovered that enables an attacker to execute arbitrary code under Solaris OS. This vulnerability was discovered and publicly announced by Internet Security Systems Inc. All Cisco products and applications that are installed on Solaris OS are considered vulnerable to the underlying operating system vulnerability, unless steps have been taken to disable access services such as "bin/login." We are investigating othe
Suricata
GPL EXPLOIT login buffer non-evasive overflow attempt
suricata·2010-09-23
CVE-2001-0797 GPL EXPLOIT login buffer non-evasive overflow attempt
GPL EXPLOIT login buffer non-evasive overflow attempt
Rule: alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"GPL EXPLOIT login buffer non-evasive overflow attempt"; flow:established,to_server; flowbits:isnotset,ttyprompt; flowbits:set,ttyprompt; content:"|FF FA|'|00 00|"; rawbytes; pcre:"/T.*?T.*?Y.*?P.*?R.*?O.*?M.*?P.*?T/RBi"; reference:bugtraq,3681; reference:cve,2001-0797; classtype:attempted-admin; sid:2103274; rev:6; metadata:created_at 2010_09_23, cve CVE_2001_0797, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)
Exploit-DB
System V Derived /bin/login - Extraneous Arguments Buffer Overflow (Metasploit)
exploitdb·2010-07-03
CVE-2001-0797 System V Derived /bin/login - Extraneous Arguments Buffer Overflow (Metasploit)
System V Derived /bin/login - Extraneous Arguments Buffer Overflow (Metasploit)
---
##
# $Id: manyargs.rb 9669 2010-07-03 03:13:45Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'System V Derived /bin/login Extraneous Arguments Buffer Overflow',
'Description' => %q{
This exploit connects to a system's modem over dialup and exploits
a buffer overlflow vulnerability in it's System V derived /bin/login.
The vulnerability is triggered by providing a large number of arguments.
},
'References' =>
[
[ 'CVE', '2001-0797'],
[ 'OSVDB', '690'
Exploit-DB
Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (2) (Metasploit)
exploitdb·2010-06-22
CVE-2001-0797 Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (2) (Metasploit)
Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (2) (Metasploit)
---
##
# $Id: ttyprompt.rb 9583 2010-06-22 19:11:05Z todb $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
'Description' => %q{
This module uses a buffer overflow in the Solaris 'login'
application to bypass authentication in the telnet daemon.
},
'Author' => [ 'MC', 'cazz' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9583 $',
'References' =>
[
[ 'CVE', '2001-0797'],
[ 'OSVDB', '690'],
[ 'BID', '5531'],
],
'Privi
Exploit-DB
Solaris 2.5.1/2.6/7/8 rlogin (SPARC) - '/bin/login' Remote Buffer Overflow
exploitdb·2004-12-24·CVSS 10.0
CVE-2001-0797 [CRITICAL] Solaris 2.5.1/2.6/7/8 rlogin (SPARC) - '/bin/login' Remote Buffer Overflow
Solaris 2.5.1/2.6/7/8 rlogin (SPARC) - '/bin/login' Remote Buffer Overflow
---
/*
* $Id: raptor_rlogin.c,v 1.1 2004/12/04 14:44:38 raptor Exp $
*
* raptor_rlogin.c - (r)login, Solaris/SPARC 2.5.1/2.6/7/8
* Copyright (c) 2004 Marco Ivaldi
*
* Buffer overflow in login in various System V based operating systems
* allows remote attackers to execute arbitrary commands via a large number
* of arguments through services such as telnet and rlogin (CVE-2001-0797).
*
* Dedicated to my beautiful croatian ladies (hello Zrinka!) -- August 2004
*
* This remote root exploit uses the (old) System V based /bin/login
* vulnerability via the rlogin attack vector, returning into the .bss
* section to effectively bypass the non-executable stack protection
* (noexec_user_stack=1 in /etc/system).
*
* Many tha
Exploit-DB
Solaris 2.x/7.0/8 - Derived 'login' Remote Buffer Overflow
exploitdb·2003-01-09
CVE-2001-0797 Solaris 2.x/7.0/8 - Derived 'login' Remote Buffer Overflow
Solaris 2.x/7.0/8 - Derived 'login' Remote Buffer Overflow
---
source: https://www.securityfocus.com/bid/3681/info
The 'login' program is used in UNIX systems to authenticate users with a username and password. The utility is typically invoked at the console, by 'telnetd', 'rlogind', and if configured to do so, SSH.
Versions of 'login' descended from System V UNIX contain a buffer overflow when handling environment variables. Several operating systems such as Solaris/SunOS, HP-UX, AIX, IRIX, and Unixware contain vulnerable versions of 'login'.
Unauthenticated clients can exploit this issue to execute arbitrary code as root. On systems where 'login' is installed setuid root, local attackers can elevate privileges.
#!/usr/bin/perl
#
# Date: 09/01/2003
# Author: snooq [http://www.angelf
Exploit-DB
Solaris 2.6/7/8 - 'TTYPROMPT in.telnet' Remote Authentication Bypass
exploitdb·2002-11-02
CVE-2001-0797 Solaris 2.6/7/8 - 'TTYPROMPT in.telnet' Remote Authentication Bypass
Solaris 2.6/7/8 - 'TTYPROMPT in.telnet' Remote Authentication Bypass
---
Solaris TTYPROMPT Security Vulnerability (Telnet)
This vulnerability is very simple to exploit, since it does not require
any code to be compiled by an attacker. The vulnerability only requires
the attacker to simply define the environment variable TTYPROMPT to a
6-character string, inside telnet. Jonathan believes this overflows an
integer inside login, which specifies whether the user has been
authenticated (just a guess).
Once connected to the remote host, you must type the username, followed
by 64 " c"s, and a literal "\n". You will then be logged in as the user
without any password authentication. This should work with any account
except root (unless remote root login is allowed).
Example:
coma% telnet
telne
Exploit-DB
Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (1) (Metasploit)
exploitdb·2002-01-18
CVE-2001-0797 Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (1) (Metasploit)
Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (1) (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
'Description' => %q{
This module uses a buffer overflow in the Solaris 'login'
application to bypass authentication in the telnet daemon.
},
'Author' => [ 'MC', 'cazz' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'CVE', '2001-0797'],
[ 'OSVDB', '690'],
[ 'BID', '5531'],
],
'Privileged' => false,
'Platform' => ['unix', 'solaris'],
'
Exploit-DB
Solaris /bin/login (SPARC/x86) - Remote Code Execution
exploitdb·2001-12-20
CVE-2001-0797 Solaris /bin/login (SPARC/x86) - Remote Code Execution
Solaris /bin/login (SPARC/x86) - Remote Code Execution
---
/*
* 7350963 - /bin/login remote root explot SPARC/x86
*
* TESO CONFIDENTIAL - SOURCE MATERIALS
*
* This is unpublished proprietary source code of TESO Security.
*
* (C) COPYRIGHT TESO Security, 2001
* All Rights Reserved
*
* bug found by scut 2001/12/20
* thanks to halvar,scut,typo,random,edi,xdr.
* special thanks to security.is.
*
* keep it private!
* don't distribute!
*/
//#define X86_FULL_PACKAGE
#include
#include
#include
#include
#include
#include
void usage()
{
printf("usage: ./7350963 ip_of_the_victim\n");
}
void dump_hex(char *str,char *data,int len)
{
int i;
if(str)
{
printf("\n=======%s:%d========\n",str,len);
}
else
{
printf("\n=======================\n");
}
for(i=0; i 0)
{
wc=send(sock,send_data,send_len,0);
}
rc
Exploit-DB
System V Derived /bin/login - Extraneous Arguments Buffer Overflow (modem based) (Metasploit)
exploitdb·2001-12-12
CVE-2001-0797 System V Derived /bin/login - Extraneous Arguments Buffer Overflow (modem based) (Metasploit)
System V Derived /bin/login - Extraneous Arguments Buffer Overflow (modem based) (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'System V Derived /bin/login Extraneous Arguments Buffer Overflow',
'Description' => %q{
This exploit connects to a system's modem over dialup and exploits
a buffer overlflow vulnerability in it's System V derived /bin/login.
The vulnerability is triggered by providing a large number of arguments.
},
'References' =>
[
[ 'CVE', '2001-0797'],
[ 'OSVDB', '690'],
[ 'OSVDB', '691'],
[ 'BID', '3681'],
[ 'URL
Metasploit
Solaris in.telnetd TTYPROMPT Buffer Overflow
metasploit
Solaris in.telnetd TTYPROMPT Buffer Overflow
Solaris in.telnetd TTYPROMPT Buffer Overflow
This module uses a buffer overflow in the Solaris 'login' application to bypass authentication in the telnet daemon.
Metasploit
System V Derived /bin/login Extraneous Arguments Buffer Overflow
metasploit
System V Derived /bin/login Extraneous Arguments Buffer Overflow
System V Derived /bin/login Extraneous Arguments Buffer Overflow
This exploit connects to a system's modem over dialup and exploits a buffer overflow vulnerability in it's System V derived /bin/login. The vulnerability is triggered by providing a large number of arguments.
ftp://patches.sgi.com/support/free/security/advisories/20011201-01-Iftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.40/CSSA-2001-SCO.40.txthttp://marc.info/?l=bugtraq&m=100844757228307&w=2http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/213http://www-1.ibm.com/support/search.wss?rs=0&q=IY26221&apar=onlyhttp://www.cert.org/advisories/CA-2001-34.htmlhttp://www.kb.cert.org/vuls/id/569272http://www.securityfocus.com/archive/1/246487http://www.securityfocus.com/bid/3681http://xforce.iss.net/alerts/advise105.phphttps://exchange.xforce.ibmcloud.com/vulnerabilities/7284https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2025ftp://patches.sgi.com/support/free/security/advisories/20011201-01-Iftp://stage.caldera.com/pub/security/openserver/CSSA-2001-SCO.40/CSSA-2001-SCO.40.txthttp://marc.info/?l=bugtraq&m=100844757228307&w=2http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/213http://www-1.ibm.com/support/search.wss?rs=0&q=IY26221&apar=onlyhttp://www.cert.org/advisories/CA-2001-34.htmlhttp://www.kb.cert.org/vuls/id/569272http://www.securityfocus.com/archive/1/246487http://www.securityfocus.com/bid/3681http://xforce.iss.net/alerts/advise105.phphttps://exchange.xforce.ibmcloud.com/vulnerabilities/7284https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2025
2001-12-12
Published
Exploited in the wild