A security vulnerability in the in.telnetd(1M) daemon shipped with Solaris 10 may allow a local or remote unprivileged user who is able to connect to a host using the telnet(1) service to gain unauthorized access to that host by connecting as any user on the system, allowing them to execute arbitrary commands with the privileges of that user. This would include the root user (uid 0) if the host is configured to accept telnet logins as the root user.

Note: There is at least one WORM in existence that is making use of this exploit to compromise system integrity.

This issue is described in the following documents:

CERT VU#881872 at http://www.kb.cert.org/vuls/id/881872

CVE-2007-0882 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0882