{"id":154530,"date":"2026-01-20T23:11:56","date_gmt":"2026-01-20T21:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii"},"modified":"2026-01-20T23:11:56","modified_gmt":"2026-01-20T21:11:56","slug":"uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","title":{"rendered":"Zranitelnost v telnetd umo\u017e\u0148uj\u00edc\u00ed p\u0159ipojen\u00ed s pr\u00e1vy root bez autentizace","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Na serveru telnetd z bal\u00ed\u010dku GNU InetUtils byla odhalena zranitelnost, kter\u00e1 umo\u017e\u0148uje p\u0159ipojen\u00ed pod jak\u00fdmikoli u\u017eivateli, v\u010detn\u011b u\u017eivatele root, bez ov\u011b\u0159en\u00ed hesla. Identifik\u00e1tor CVE zat\u00edm nebyl p\u0159id\u011blen. Zranitelnost se projevuje od verze InetUtils 1.9.3 (2015) a z\u016fst\u00e1v\u00e1 neopraven\u00e1 v aktu\u00e1ln\u00edm vyd\u00e1n\u00ed 2.7.0. Oprava je dostupn\u00e1 ve form\u011b patch\u016f (1, 2). <\/p>\n

Probl\u00e9m vznik\u00e1 z toho, \u017ee pro ov\u011b\u0159en\u00ed hesla proces telnetd vyvol\u00e1v\u00e1 n\u00e1stroj \u201e\\\/usr\\\/bin\\\/login\u201c, p\u0159i\u010dem\u017e jako argument p\u0159ed\u00e1v\u00e1 u\u017eivatelsk\u00e9 jm\u00e9no, kter\u00e9 klient uvedl p\u0159i p\u0159ipojen\u00ed k serveru<\/a>. N\u00e1stroj \u201elogin\u201c podporuje volbu \u201e-f\u201c, kter\u00e1 umo\u017e\u0148uje p\u0159ihl\u00e1\u0161en\u00ed bez prov\u00e1d\u011bn\u00ed autentizace (p\u0159edpokl\u00e1d\u00e1 se, \u017ee tato volba se pou\u017e\u00edv\u00e1, kdy\u017e u\u017eivatel ji\u017e pro\u0161el ov\u011b\u0159en\u00edm). Tak\u017ee pokud se poda\u0159\u00ed dosadit volbu \u201e-f\u201c do u\u017eivatelsk\u00e9ho jm\u00e9na, je mo\u017en\u00e9 se p\u0159ipojit bez ov\u011b\u0159en\u00ed hesla. <\/p>\n

P\u0159i b\u011b\u017en\u00e9m p\u0159ipojen\u00ed nelze pou\u017e\u00edt u\u017eivatelsk\u00e9 jm\u00e9no ve form\u00e1tu \u201e-f root\u201c, ale v telnetu existuje re\u017eim automatick\u00e9ho p\u0159ihl\u00e1\u0161en\u00ed, kter\u00fd je aktivov\u00e1n volbou \u201e-a\u201c. V tomto re\u017eimu u\u017eivatelsk\u00e9 jm\u00e9no nen\u00ed p\u0159evzato z p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku, ale je p\u0159ed\u00e1v\u00e1no prost\u0159ednictv\u00edm prom\u011bnn\u00e9 prost\u0159ed\u00ed USER. P\u0159i vyvol\u00e1n\u00ed n\u00e1stroje login byla hodnota t\u00e9to prom\u011bnn\u00e9 prost\u0159ed\u00ed dosazena bez dodate\u010dn\u00e9ho ov\u011b\u0159en\u00ed a bez escapov\u00e1n\u00ed speci\u00e1ln\u00edch znak\u016f. Tak\u017ee pro p\u0159ipojen\u00ed pod u\u017eivatelsk\u00fdm jm\u00e9nem root sta\u010d\u00ed nastavit hodnotu \u201e-f root\u201c do prom\u011bnn\u00e9 prost\u0159ed\u00ed USER a p\u0159ipojit se k telnetov\u00e9mu serveru s volbou \u201e-a\u201c: $ USER='-f root' telnet -a jm\u00e9no_serveru <\/p>\n

Zm\u011bna, kter\u00e1 vedla k zranitelnosti, byla p\u0159id\u00e1na do k\u00f3du telnetd v b\u0159eznu 2015 a souvisela s odstran\u011bn\u00edm probl\u00e9mu, kter\u00fd neumo\u017e\u0148oval ur\u010dit u\u017eivatelsk\u00e9 jm\u00e9no v re\u017eimu autologin bez autentifikace v Kerberosu. Jako \u0159e\u0161en\u00ed byla p\u0159id\u00e1na podpora p\u0159enosu u\u017eivatelsk\u00e9ho jm\u00e9na pro re\u017eim autologin prost\u0159ednictv\u00edm prom\u011bnn\u00e9 prost\u0159ed\u00ed, ale kontrolu spr\u00e1vnosti u\u017eivatelsk\u00e9ho jm\u00e9na z prom\u011bnn\u00e9 prost\u0159ed\u00ed zapomn\u011bli p\u0159idat.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 InetUtils 1.9.3 (2015 \u0433\u043e\u0434) \u0438 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 2.7.0. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0435\u0439 (1, 2). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-154530","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v telnetd, kter\u00e1 umo\u017e\u0148uje p\u0159ipojen\u00ed s pr\u00e1vy root bez autentifikace | ProHoster","description":"Na serveru telnetd z bal\u00ed\u010dku GNU InetUtils byla odhalena zranitelnost, kter\u00e1 umo\u017e\u0148uje p\u0159ipojen\u00ed pod jak\u00fdmikoli u\u017eivateli, v\u010detn\u011b u\u017eivatele root, bez ov\u011b\u0159en\u00ed hesla.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 telnetd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-20T21:11:56+00:00","article:modified_time":"2026-01-20T21:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"154530","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:43:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 21:11:56","updated":"2026-02-09 21:43:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/154530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=154530"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/154530\/revisions"}],"predecessor-version":[{"id":160238,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/154530\/revisions\/160238"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=154530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=154530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=154530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}