Vulnerability found by Flare@CiSO Greets to nolimit, COREiSO, #news, and class101. Versions Tested: RPC-3 Telnet Host - Revision F 3.05, (C) 1998 This is a basic login-bypass vulnerability found in the RPC-3 Telnet Host v 3.05 made by "Bay Technical Associates". This telnet daemon is used by many hardware appliances, often times power supplies. When a user logs into this telnet daemon they are able to gain full control of the device (in this example a power supply). We consider this vulnerability an extreme risk as it could allow an unauthorized user to login to a power supply, and disable power to a machine, thereby completely shutting down and disabling the aforementioned machine (or anything else connected to such a power supply). To carry out this exploit an attacker simply needs to telnet to the RPC-3 Telnet daemon on the standard telnet port, and when prompted for the username hit the escape key, and then enter. The attacker will then be logged into the Telnet Daemon. This attack was tested on RPC-3 Telnet Host version 3.05. Other versions were not available for testing; they may or may not prove to have the same vulnerability. Example: RPC-3 Telnet Host Revision F 3.05, (C) 1998 Bay Technical Associates Unit ID: RPC3 Enter username> [escape key] [enter] Login successful. Available RPC3 Outlets For command summary, enter HELP Circuit Breaker: On Selection Outlet Outlet Power Number Name Number Status RPC3> [attacker now has control of the appliance]
This archive was generated by hypermail 2.1.3 : Thu Mar 31 2005 - 13:05:05 PST