Following the vulnerability discovered at the end of January, which allowed connection as the root user without password verification, several privilege escalation methods have been identified in the telnetd server from the GNU InetUtils suite. These are a result of the incomplete remediation of the vulnerability from 1999 (CVE-1999-0073). <\/p>\n
S\u00e5rbarhederne skyldes, at telnetd muligg\u00f8r transmission af milj\u00f8variabler fra klienten til serveren ved hj\u00e6lp af ENVIRON-optionen. S\u00e5danne milj\u00f8variabler s\u00e6ttes og behandles i konteksten af telnetd's proces og sendes til de b\u00f8rneprocesser, der startes af den, inklusive den proces \/bin\/login, der k\u00f8res med root-rettigheder. S\u00e5rbarheden CVE-1999-0073 tillod telnet-klienten at sende milj\u00f8variablen LD_LIBRARY_PATH, hvis ops\u00e6tning f\u00f8rer til indl\u00e6sning af den brugerdefinerede delte biblioteksfil ved opstart af login-processen. Hvis en angriber kan uploade filer til en maskine, der underst\u00f8tter telnet-forbindelse, kan de indl\u00e6se et specielt designet bibliotek og organisere dets indl\u00e6sning med root-rettigheder. <\/p>\n
I GNU InetUtils-telnetd blev s\u00e5rbarheden l\u00f8st ved at forbyde farlige milj\u00f8variabler gennem filtrering af maskerne \u00abLD_\u00bb, \u00abLIBPATH\u00bb, \u00abENV\u00bb, \u00abIFS\u00bb og \u00ab_RLD_\u00bb. Den ublokkerede milj\u00f8variabel \u00abCREDENTIALS_DIRECTORY\u00bb, der behandles ved opstart af \/usr\/bin\/login, gjorde det muligt for brugeren at \u00e6ndre kataloget for konfigurationsindstillingerne og placere en fil login.noauth i det nye katalog med v\u00e6rdien \u00abyes\u00bb, hvilket aktiverer adgang uden password (svarende til at overf\u00f8re flaget \u00ab-f\u00bb til login-processen). Indstillingen g\u00e6lder for alle brugere, herunder root. <\/p>\n
Angrebet g\u00e5r ud p\u00e5, at en ikke-privilegeret bruger opretter en underkatalog i sit hjemmekatalog, uploader en fil login.noauth til det og fors\u00f8ger at logge ind ved at s\u00e6tte milj\u00f8variablen \u00abCREDENTIALS_DIRECTORY=oprettet katalog\u00bb og overf\u00f8re milj\u00f8variablen \u00abUSER=root\u00bb (i telnet er der en automatisk tilslutningsmulighed, hvor brugernavnet ikke tages fra kommandolinjen, men overf\u00f8res gennem milj\u00f8variablen USER). Eksempel p\u00e5 exploit. <\/p>\n
Der blev opdaget endnu en m\u00e5de at opn\u00e5 root-adgang via telnetd, som er relateret til manipulation af milj\u00f8variablerne OUTPUT_CHARSET og LANGUAGE, behandlet af GNU gettext-biblioteket, samt milj\u00f8variablen GCONV_PATH, der bruges i glibc. Ved at s\u00e6tte milj\u00f8variablerne OUTPUT_CHARSET og LANGUAGE kan angriberen aktivere karakterkodningskonverteringsfunktionen i gettext, hvilket kalder funktionen iconv_open(). N\u00e5r funktionen iconv_open() udf\u00f8res under indl\u00e6sning af konfigurationsfilen gconv-modules, beregnes stien under hensyntagen til milj\u00f8variablen GCONV_PATH. Ved at inds\u00e6tte filen gconv-modules kan man organisere lastningen af sin egen delt biblioteksfil under output af den lokaliserede streng af login-processen. <\/p>\n
CVE-identifikatorer for de n\u00e6vnte s\u00e5rbarheder er endnu ikke blevet tildelt. Som en beskyttelsesmetode overvejes det at implementere en hvidliste over tilladte v\u00e6rdier (\u00abTERM\u00bb, \u00abDISPLAY\u00bb, \u00abUSER\u00bb, \u00abLOGNAME\u00bb og \u00abPOSIXLY_CORRECT\u00bb) ved at blokere for alle andre milj\u00f8variabler, ligesom det g\u00f8res med milj\u00f8variablerne i OpenSSH. S\u00e5rbarhederne er bekr\u00e6ftet i GNU InetUtils-pakken, implementationen. server<\/a> Opdagelsen af en s\u00e5rbarhed i slutningen af januar, der gjorde det muligt at tilslutte sig som root-bruger uden passwordkontrol, der er fundet flere m\u00e5der til at h\u00e6ve sine privilegier i telnetd-serveren fra GNU InetUtils-pakken. \u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0435\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f, \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u0441\u0442\u0430\u0432\u0448\u0438\u0445 \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435\u043c \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 1999 \u0433\u043e\u0434\u0443 (CVE-1999-0073). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0432 telnetd \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u043f\u0446\u0438\u0438 ENVIRON. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-162791","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47En r\u00e6kke nye s\u00e5rbarheder i telnetd, der muligg\u00f8r opn\u00e5else af root-rettigheder i systemet | ProHoster","description":"Efter den s\u00e5rbarhed, der blev opdaget i slutningen af januar, der gjorde det muligt at oprette forbindelse som root-bruger uden passwordkontrol, er der fundet flere metoder til at h\u00e6ve privilegierne i telnetd-serveren fra GNU InetUtils.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/seriya-novyh-uyazvimostej-v-telnetd-pozvolyayushhih-poluchit-root-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0440\u0438\u044f \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 telnetd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0435\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f, \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/seriya-novyh-uyazvimostej-v-telnetd-pozvolyayushhih-poluchit-root-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-25T15:11:54+00:00","article:modified_time":"2026-02-25T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"162791","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-25 15:12:53","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-25 15:11:55","updated":"2026-02-25 15:12:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/162791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=162791"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/162791\/revisions"}],"predecessor-version":[{"id":165657,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/162791\/revisions\/165657"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=162791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=162791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=162791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"