A vulnerability has been identified in the telnetd server from the GNU InetUtils set, allowing connections as any user, including the root user, without password verification. A CVE identifier has not yet been assigned. The vulnerability has existed since InetUtils version 1.9.3 (2015) and remains unpatched in the current release 2.7.0. A fix is available in the form of patches (1, 2).
The issue is caused by the fact that for password verification, the telnetd process calls the utility "/usr/bin/login", passing the username provided by the client upon connecting to. server. The login utility supports the "-f" option, allowing access without authentication (this option is implied to be used when the user has already been validated). Therefore, if one can inject the "-f" option into the username, it is possible to connect without password verification.
In a regular connection, using a username like "-f root" will not work, but telnet has an automatic connection mode activated by the "-a" option. In this mode, the username is not taken from the command line but is passed through the environment variable USER. When the login utility is invoked, the value of this environment variable is substituted without additional verification and without escaping special characters. Thus, to connect as the root user, it is enough to set the environment variable USER to "-f root" and connect to the telnet server with the "-a" option: $ USER='-f root' telnet -a server_name
The change that led to the vulnerability was added to the telnetd code in March 2015 and was associated with addressing a problem that prevented identifying the username in autologin mode without authentication in Kerberos. As a solution, support was added for passing the username for autologin mode via an environment variable, but the verification of the correctness of the username from the environment variable was forgotten.
Source: opennet.ru
