Computer Emergency Response Team - Industrie Services et Tertiaire



			Public Advisories/Alerts

			Cert-IST publications

			Useful links

			News - Events







		Printable version

Accueil | Resources | Public Advisories/Alerts | Alerts

Reference:	CERT-IST/AL-2007.003
Version:	1.2
Version date:	07 March 2007

Vulnerability Classification

Risk:

very-high

Impact:

Take control

Confidence:

Vendor-acknowledged

Attack expertise:

Beginner

Attack requirements:

Remote (no account) over a standard service

System Information

Affected Platform(s):

Solaris systems versions 10 and 11

Impacted products

Description

Publication context:

This alert follows the confirmation by Sun that a worm exploiting the "telnetd" daemon flaw has been detected on Internet (See the CERT-IST/AL-2007.003 alert and the CERT-IST/AV-2007.061 advisory).

Sun provides a script to cleanup an infected system (See the "Solution" section).

Problem description:

A worm that spreads exploiting the vulnerability in the "telnetd" daemon on Solaris systems versions 10 and 11 has been detected on Internet. Once installed, the worm attempts to open a backdoor on the infected system.

Note : Cert-IST has noticed this worm in France.

Technical context:

Solaris 11 is the name of the Solaris version currently under development. It can be downloaded by the subscribers of the "Solaris Express" program.

Diagnostic:

To check if a Solaris 10 or 11 system is infected :

1 - Execute the following command :

$ ls -la /var/adm/wtmpx

if the permissions are :

-rw-r--rw- 1 adm adm 1116 Feb 28 12:03 wtmpx

the system may be infected.

2 - Execute the following command :

$ ls -la /var/adm/sa

if a directory named .adm is present, the system is probably infected.

3 - If the following files are present on the system, the infection is even more problable.

/var/adm/.profile
/var/spool/lp/.profile

Solution

01 - Apply the Sun patches regarding the "telnetd" daemon vulnerability

	Sparc	Intel
Solaris 10	120068-02	120069-02

Sun patches
- http://sunsolve.sun.com/securitypatch

02 - Temporary workarounds for the vulnerability in the "telnetd" daemon

The following workarounds are available to reduce exposure to the attacks :

Disable the "telnetd" daemon : svcadm disable telnet
Filter the port 23 on network devices close to the vulnerable Solaris servers, or on the Internet/LAN connectivity
Harden the authentication of the "telnetd" daemon : inetadm -m svc:/network/telnet:default exec="/usr/sbin/in.telnetd -a user"

03 - Sun script to cleanup an infected Solaris 10 or 11 system