CVE-2020-14871 PoC — Oracle Solaris 缓冲区错误漏洞

Source

Associated Vulnerability

Description

This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH.

Readme

# EvilSun Vulnerability Checker (CVE-2020-14871)

This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH. A successful exploit could potentially lead to remote code execution or denial of service.

## Requirements 

*   Python 3.x
*   `paramiko` library

## Installation

```bash
pip3 install -r requirements.txt
```

## Interpreting Output

### Solaris 9 & 10

When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDInt 'yes' you can expect the following output indicating a vulnerable state:
<pre>
    [*] Connecting to hostname 192.168.100.12 port: 22
    [*] Using payload: ['AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA']
    [*] Authentication failed: Authentication failed: transport shut down or saw EOF
    [-] !!!!!!! VULNERABLE !!!!!!!
</pre>

When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDIn 'no' you can expect the following output indicating a non-vulnerable state (for Sun SSHd anyway):

<pre>
    [*] Connecting to hostname 192.168.100.12 port: 22
    [*] Authentication failed: Authentication failed.
</pre>

### Solaris 11

Currently untested. 

File Snapshot

 [4.0K]  /data/pocs/91e2451e6830724289241735c882a032e82dcf49
├── [1.8K]  evilsun_check.py
├── [1.8K]  README.md
└── [   8]  requirements.txt

0 directories, 3 files

Remarks