CVE-2020-14871 PoC — Oracle Solaris 缓冲区错误漏洞

Description

This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH.

介绍

# EvilSun Vulnerability Checker (CVE-2020-14871)

This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH. A successful exploit could potentially lead to remote code execution or denial of service.

## Requirements 

*   Python 3.x
*   `paramiko` library

## Installation

```bash
pip3 install -r requirements.txt
```

## Interpreting Output

### Solaris 9 & 10

When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDInt 'yes' you can expect the following output indicating a vulnerable state:
<pre>
    [*] Connecting to hostname 192.168.100.12 port: 22
    [*] Using payload: ['AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA']
    [*] Authentication failed: Authentication failed: transport shut down or saw EOF
    [-] !!!!!!! VULNERABLE !!!!!!!
</pre>

When /etc/ssh/sshd_config has been configured with PAMAuthenticationViaKBDIn 'no' you can expect the following output indicating a non-vulnerable state (for Sun SSHd anyway):

<pre>
    [*] Connecting to hostname 192.168.100.12 port: 22
    [*] Authentication failed: Authentication failed.
</pre>

### Solaris 11

Currently untested. 

文件快照

备注