rpc3telnet.txt

`Vulnerability found by Flare@CiSO  
Greets to nolimit, COREiSO, #news, and class101.  
  
Versions Tested:  
RPC-3 Telnet Host - Revision F 3.05, (C) 1998  
  
This is a basic login-bypass vulnerability found in the RPC-3 Telnet  
Host v 3.05 made by "Bay Technical Associates". This telnet daemon is  
used by many hardware appliances, often times power supplies. When a  
user logs into this telnet daemon they are able to gain full control  
of the device (in this example a power supply). We consider this  
vulnerability an extreme risk as it could allow an unauthorized user  
to login to a power supply, and disable power to a machine, thereby  
completely shutting down and disabling the aforementioned machine (or  
anything else connected to such a power supply).  
  
To carry out this exploit an attacker simply needs to telnet to the  
RPC-3 Telnet daemon on the standard telnet port, and when prompted for  
the username hit the escape key, and then enter. The attacker will  
then be logged into the Telnet Daemon.  
  
This attack was tested on RPC-3 Telnet Host version 3.05. Other  
versions were not available for testing; they may or may not prove to  
have the same vulnerability.  
  
Example:  
  
RPC-3 Telnet Host  
Revision F 3.05, (C) 1998  
Bay Technical Associates  
Unit ID: RPC3  
  
Enter username> [escape key] [enter]  
Login successful.  
  
Available RPC3 Outlets  
For command summary, enter HELP  
  
Circuit Breaker: On  
  
Selection Outlet Outlet Power  
Number Name Number Status  
  
RPC3> [attacker now has control of the appliance]  
`