Zero-day flaw in Solaris allows remote attacks
Security experts are warning of a zero-day vulnerability with Sun Microsystems Inc.'s Solaris 10 and 11 OSes.
Exploit code has been posted on the Internet, and no special tools are required to take advantage of it, according to an advisory from the SANS Institute.
The problem lies within Telnet, a networking protocol. The Telnet daemon -- a process that runs in the background and waits for another Telnet client to connect -- can allow a hacker to log in without a password.
SANS suggests a couple of solutions: disable Telnet or limit the IP (Internet Protocol) addresses that can connect to Telnet through the firewall.
In the past, SANS has warned that using Telnet poses a risk because data transferred between clients may not be encrypted. Telnet is also a frequent target for port scanners.
"In my opinion, no one should be running Telnet open to the Internet," wrote Donald Smith of SANS.
IDG News Service
Build your tech library with our book giveaways.
Hacking Exposed, Sixth Edition
By Stuart McClure, Joel Scambray, George Kurtz; Published by McGraw-Hill/Osborne
The original Hacking Exposed authors rejoin forces on this tenth anniversary edition to offer completely up-to-date coverage of today's most devastating hacks and how to prevent them. Using their proven methodology, the authors reveal how to locate and patch system vulnerabilities. The book includes new coverage of ISO images, wireless and RFID attacks, Web 2.0 vulnerabilities, anonymous hacking tools, Ubuntu, Windows Server 2008, mobile devices, and more. Enter now!
