{"id":155278,"date":"2026-01-26T11:12:14","date_gmt":"2026-01-26T09:12:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya"},"modified":"2026-01-26T11:12:14","modified_gmt":"2026-01-26T09:12:14","slug":"login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","title":{"rendered":"Login, mezera, poml\u010dka, root. Chyba v telnetu umo\u017e\u0148uje ukr\u00e1st po\u010d\u00edta\u010d bez hesla.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zranitelnost v bal\u00ed\u010dku GNU InetUtils zas\u00e1hla v\u0161echny verze od 1.9.3 do 2.7 v\u010detn\u011b.<\/p>\n

Zd\u00e1 se, \u017ee telnet d\u00e1vno ode\u0161el do minulosti spolu s modemy a dial-up, ale pr\u00e1v\u011b on se n\u00e1hle stal zdrojem v\u00e1\u017en\u00e9 zranitelnosti. V GNU InetUtils byla objevena chyba, kter\u00e1 umo\u017e\u0148uje vzd\u00e1len\u00fd p\u0159\u00edstup do syst\u00e9mu jako root bez hesla, sta\u010d\u00ed jen poslat speci\u00e1ln\u011b vytvo\u0159enou hodnotu prom\u011bnn\u00e9 prost\u0159ed\u00ed.<\/p>\n

Probl\u00e9m se t\u00fdk\u00e1 telnetd serveru, kter\u00fd je sou\u010d\u00e1st\u00ed GNU InetUtils. Ten p\u0159ed\u00e1v\u00e1 programu login hodnotu prom\u011bnn\u00e9 USER, kterou obdr\u017eel od klienta, bez jak\u00e9koli kontroly. Tohoto lze vyu\u017e\u00edt, pokud klient ode\u0161le \u0159et\u011bzec \u201e-f root\u201c jako USER a p\u0159ipoj\u00ed se s parametrem telnet -a nebo \u2013login. V d\u016fsledku toho je login vn\u00edm\u00e1n jako slu\u017eebn\u00ed p\u0159\u00edznak, p\u0159esko\u010d\u00ed standardn\u00ed proces ov\u011b\u0159ov\u00e1n\u00ed a automaticky autorizuje u\u017eivatele jako root.<\/p>\n

Zranitelnost m\u00e1 identifik\u00e1tor CVE-2026-24061 a hodnocen\u00ed podle CVSS: 9.8. V ohro\u017een\u00ed jsou v\u0161echny verze GNU InetUtils, po\u010d\u00ednaje 1.9.3 a kon\u010de 2.7 v\u010detn\u011b. Chyba je v projektu p\u0159\u00edtomna t\u00e9m\u011b\u0159 11 let, od kv\u011btna 2015, ale byla odhalena a\u017e nyn\u00ed. V podstat\u011b jde o klasick\u00fd p\u0159\u00edklad zranitelnosti star\u00e9 \u0161koly, kde nebezpe\u010dn\u00fd \u0159et\u011bzec bez filtrace je pos\u00edl\u00e1n syst\u00e9mov\u00e9 utilit\u011b s privilegii root.<\/p>\n

Auto\u0159i advisoriu p\u0159\u00edmo doporu\u010duj\u00ed v\u016fbec nepou\u017e\u00edvat telnetd, omezit p\u0159\u00edstup k telnet portu pouze na d\u016fv\u011bryhodn\u00e9 klienty a co nejd\u0159\u00edve nainstalovat opravu nebo p\u0159ej\u00edt na verzi, ve kter\u00e9 byl probl\u00e9m vy\u0159e\u0161en. Do\u010dasn\u00fdm \u0159e\u0161en\u00edm m\u016f\u017ee b\u00fdt \u00fapln\u00e9 vypnut\u00ed telnetd nebo pou\u017eit\u00ed p\u0159izp\u016fsoben\u00e9 verze login, kter\u00e1 nepodporuje parametr \"-f\".<\/p>\n

Zranitelnost odhalil v\u00fdzkumn\u00edk Carlos Cortes \u00c1lvarez, patch byl p\u0159ipraven a upraven v\u00fdvoj\u00e1\u0159i GNU InetUtils v lednu 2026. Opravy zahrnuj\u00ed sanitaci v\u0161ech prom\u011bnn\u00fdch, kter\u00e9 se pou\u017e\u00edvaj\u00ed p\u0159i vytv\u00e1\u0159en\u00ed p\u0159\u00edkazu pro vol\u00e1n\u00ed login, aby takov\u00e9to \u00fatoky byly principi\u00e1ln\u011b nemo\u017en\u00e9.<\/p>\n

Cel\u00e1 historie vypad\u00e1 t\u00e9m\u011b\u0159 symbolicky: zastaral\u00fd protokol, zapomenut\u00e1 slu\u017eba a klasick\u00e1 logick\u00e1 chyba vedly k \u00fapln\u00e9 kompromitaci syst\u00e9mu. Dal\u0161\u00ed p\u0159ipom\u00ednka, \u017ee i \"star\u00e9\" technologie mohou z\u016fstat skute\u010dnou hrozbou, pokud st\u00e1le b\u011b\u017e\u00ed v produk\u010dn\u00edm prost\u0159ed\u00ed.<\/p>\n

Ihned po publikaci informace o zranitelnosti t\u00fdm v\u00fdzkumn\u00edk\u016f nasadil honeypot senzory, aby sledoval skute\u010dn\u00e9 pokusy o exploitaci. \u00dato\u010dn\u00edci se nenechali dlouho \u010dekat. B\u011bhem 18 hodin pozorov\u00e1n\u00ed bylo zaznamen\u00e1no 60 pokus\u016f o prolomen\u00ed od 18 unik\u00e1tn\u00edch IP adress<\/a>. Podle platformy Censys bylo potenci\u00e1ln\u011b zraniteln\u00fdch p\u0159ibli\u017en\u011b t\u0159i tis\u00edce syst\u00e9m\u016f po cel\u00e9m sv\u011bt\u011b, a\u010dkoliv zna\u010dn\u00e1 \u010d\u00e1st z nich pravd\u011bpodobn\u011b tak\u00e9 byla honeypot pasti.<\/p>\n

Anal\u00fdza zachycen\u00e9ho provozu uk\u00e1zala velmi pestr\u00fd obr\u00e1zek. Nejaktivn\u011bj\u0161\u00edm se uk\u00e1zal \u00fato\u010dn\u00edk s adresy 178.16.53.82, kter\u00fd provedl 12 sezen\u00ed proti 10 r\u016fzn\u00fdm c\u00edl\u016fm. Jeho \u010dinnosti byly pln\u011b automatizovan\u00e9: po z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu se spustil standardn\u00ed soubor p\u0159\u00edkaz\u016f pro pr\u016fzkum jako uname -a, id, \u010dten\u00ed \/proc\/cpuinfo a \/etc\/passwd. Charakeristick\u00fdm rysem byla ob\u00e1lka v\u00fdstupu p\u0159\u00edkaz\u016f speci\u00e1ln\u00edmi zna\u010dkami pro n\u00e1sledn\u00e9 parsov\u00e1n\u00ed, co\u017e jasn\u011b nazna\u010duje botnet nebo automatizovan\u00fd syst\u00e9m sb\u011bru dat.<\/p>\n

Slo\u017eit\u011bj\u0161\u00ed se uk\u00e1zal \u00fato\u010dn\u00edk s adresy 216.106.186.24. Soust\u0159edil se na konkr\u00e9tn\u00ed pods\u00ed\u0165 a pokusil se nainstalovat SSH kl\u00ed\u010d pro trval\u00fd p\u0159\u00edstup, a tak\u00e9 nahr\u00e1t a spustit Python skript z extern\u00edho serveru \u2014 pravd\u011bpodobn\u011b \u0161kodliv\u00fd software pro kryptom\u011bnov\u00e9 dolov\u00e1n\u00ed nebo botnet. Pravda, ob\u011b pokusy selhaly: na c\u00edlov\u00e9m syst\u00e9mu neexistoval adres\u00e1\u0159 .ssh, a chyb\u011bly tak\u00e9 curl a python.<\/p>\n

Zvl\u00e1\u0161tn\u00ed z\u00e1jem vzbuzuj\u00ed dva \u00fato\u010dn\u00edci s adresami 167.172.111.135 a 165.22.30.48. Na rozd\u00edl od ostatn\u00edch se nepokou\u0161eli okam\u017eit\u011b z\u00edskat root p\u0159\u00edstup, ale experimentovali s \u00fa\u010dty nobody, daemon a dokonce neexistuj\u00edc\u00edm nonexistent123. Zpo\u017ed\u011bn\u00ed mezi sezen\u00edmi a logika \u010din\u016f ukazuj\u00ed na \u017eiv\u00e9ho \u010dlov\u011bka za kl\u00e1vesnic\u00ed. Pravd\u011bpodobn\u011b se jedn\u00e1 o zku\u0161en\u011bj\u0161\u00ed hackery, kte\u0159\u00ed v\u011bd\u00ed o syst\u00e9mech detekce vniknut\u00ed a maj\u00ed v z\u00e1loze techniky pro zvy\u0161ov\u00e1n\u00ed opr\u00e1vn\u011bn\u00ed.<\/p>\n

N\u011bkte\u0159\u00ed \u00fato\u010dn\u00edci p\u0159edv\u00e1d\u011bli ohromuj\u00edc\u00ed nedbalost v opera\u010dn\u00ed bezpe\u010dnosti. Nap\u0159\u00edklad \u00fato\u010dn\u00edk z adresy 67.220.95.16 pou\u017e\u00edval stejnou IP jak pro explozi, tak pro hostov\u00e1n\u00ed serveru s malwarem. Jin\u00ed n\u00e1hodn\u011b odhalovali n\u00e1zvy sv\u00fdch hostitel\u016f prost\u0159ednictv\u00edm prom\u011bnn\u00e9 DISPLAY: jeden pracoval ze syst\u00e9mu nazvan\u00e9ho MiniBear, jin\u00fd z virtu\u00e1ln\u00edho stroje shared-vm2.localdomain, a t\u0159et\u00ed se dokonce p\u0159ipojil p\u0159\u00edmo z plnohodnotn\u00e9ho grafick\u00e9ho prost\u0159ed\u00ed Kali Linux.<\/p>\n

Celkov\u00e1 \u00farove\u0148 \u00fato\u010dn\u00edk\u016f se uk\u00e1zala jako pom\u011brn\u011b n\u00edzk\u00e1. Z 18 zdroj\u016f \u00fatok\u016f pouze n\u011bkolik prok\u00e1zalo zn\u00e1mky profesionality. V\u011bt\u0161ina pou\u017e\u00edvala nejjednodu\u0161\u0161\u00ed automatizovan\u00e9 n\u00e1stroje nebo doslova \u0165ukali do kl\u00e1ves na z\u00e1klad\u011b pokyn\u016f z internetu. Syst\u00e9m detekce pr\u016fnik\u016f Suricata \u00fasp\u011b\u0161n\u011b zachytil okam\u017eik z\u00edsk\u00e1n\u00ed root p\u0159\u00edstupu jedn\u00edm z \u00fato\u010dn\u00edk\u016f, co\u017e znovu potvrzuje d\u016fle\u017eitost v\u00edcestup\u0148ov\u00e9 ochrany a monitorov\u00e1n\u00ed s\u00ed\u0165ov\u00e9ho provozu.<\/p>\n

V\u00fdzkumn\u00edci uv\u00e1d\u011bj\u00ed, \u017ee tato zranitelnost jedn\u00edm zp\u016fsobem umo\u017enila amat\u00e9rsk\u00fdm hacker\u016fm si vyzkou\u0161et, ale na druh\u00e9 stran\u011b umo\u017enila bezpe\u010dnostn\u00edm odborn\u00edk\u016fm shrom\u00e1\u017edit cenn\u00e1 data o aktu\u00e1ln\u00edch taktik\u00e1ch a n\u00e1stroj\u00edch \u00fato\u010dn\u00edk\u016f.<\/p>\n

<\/p>\n

V\u00edce informac\u00ed: https:\/\/www.securitylab.ru\/news\/568478.php<\/a><\/p>\n

<\/noindex><\/noindex><\/p>\n

Zdroj: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 GNU InetUtils \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-155278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Login, mezera, poml\u010dka, root. Chyba v telnetu umo\u017e\u0148uje p\u0159evz\u00edt po\u010d\u00edta\u010d bez hesla | ProHoster","description":"Zranitelnost v bal\u00ed\u010dku GNU InetUtils zas\u00e1hla v\u0161echny verze od 1.9.3 do 2.7 v\u010detn\u011b. Zd\u00e1lo by se, \u017ee telnet d\u00e1vno ode\u0161el do minulosti spolu s modemy a dial-upem, ale pr\u00e1v\u011b on se n\u00e1hle stal zdrojem z\u00e1va\u017en\u00e9 zranitelnosti.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0433\u0438\u043d, \u043f\u0440\u043e\u0431\u0435\u043b, \u0434\u0435\u0444\u0438\u0441, root. \u0411\u0430\u0433 \u0432 telnet \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-26T09:12:14+00:00","article:modified_time":"2026-01-26T09:12:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"155278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:42:45","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-26 09:12:14","updated":"2026-02-08 20:42:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/155278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=155278"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/155278\/revisions"}],"predecessor-version":[{"id":158081,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/155278\/revisions\/158081"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=155278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=155278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=155278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}