Sun SPARC Enterprise T5120 and T5220 Servers Insecure Default Configuration Vulnerability

Bugtraq ID:	28469
Class:	Design Error
CVE:	CVE-2008-1369
Remote:	Yes
Local:	Yes
Published:	Mar 26 2008 12:00AM
Updated:	May 07 2015 05:31PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun SPARC Enterprise T5220 Server 0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc Sun SPARC Enterprise T5120 Server 0 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6_sparc
Not Vulnerable:

Sun SPARC Enterprise T5120 and T5220 Servers Insecure Default Configuration Vulnerability

Some Sun SPARC Enterprise T5120 and T5220 Servers are shipped with an insecure default configuration for SSHD.

Successful exploits allow local and remote attackers to execute arbitrary commands with superuser privileges. This facilitates the complete compromise of affected computers.

Only Sun SPARC Enterprise T5120 and T5220 Servers running the factory-installed Solaris 10 OS image dated prior to BEL0748000 are affected.

Sun SPARC Enterprise T5120 and T5220 Servers Insecure Default Configuration Vulnerability

To exploit this issue, attackers use readily available utilities such as SSH to interact with affected computers.

Sun SPARC Enterprise T5120 and T5220 Servers Insecure Default Configuration Vulnerability

References:

• Sun SPARC Enterprise T5120 Server Homepage (Sun Microsystems)
  
• Sun SPARC Enterprise T5220 Server Homepage (Sun Microsystems)
  
• 231244: Some Sun SPARC Enterprise T5120 and T5220 Servers Shipped With an Incorr (Sun)