Following the vulnerability discovered at the end of January, which allowed connecting as the root user without password verification, several privilege escalation methods were found in the telnetd server from the GNU InetUtils suite, resulting from the incomplete elimination of a vulnerability in 1999 (CVE-1999-0073).
The vulnerabilities are caused by the ability of the telnetd to transmit environment variables from the client to the server using the ENVIRON option. Such environment variables are set and processed in the context of the telnetd process and passed to its child processes, including the /bin/login process launched with root privileges. The CVE-1999-0073 vulnerability allowed the telnet client to pass the LD_LIBRARY_PATH environment variable, which causes the specified shared library to be loaded when the login process starts. If the attacker can upload files to a system supporting telnet protocol connections, they can upload a specially crafted library and set it to load with root privileges.
In telnetd from the GNU InetUtils suite, the vulnerability was addressed by prohibiting dangerous environment variables through filtering masks 'LD_', 'LIBPATH', 'ENV', 'IFS', and '_RLD_'. However, the environment variable 'CREDENTIALS_DIRECTORY', processed during the launch of /usr/bin/login, was left unblocked. Using this environment variable, a user could change the directory for credential settings and place a login.noauth file with the value 'yes' in the new directory, activating passwordless login (similar to passing the '-f' flag to the login process). This setting applies to all users, including root.
The attack involves a non-privileged user creating a subdirectory in their home directory, uploading a login.noauth file into it, and attempting to log in by setting the environment variable 'CREDENTIALS_DIRECTORY=created directory' and passing the environment variable 'USER=root' (telnet has an automatic connection mode where the username is taken not from the command line but is passed through the USER environment variable). Example of the exploit.
Another method of gaining root access through telnetd has been identified, related to manipulating the environment variables OUTPUT_CHARSET and LANGUAGE, processed by the GNU gettext library, and the environment variable GCONV_PATH used in glibc. By setting the environment variables OUTPUT_CHARSET and LANGUAGE, an attacker can enable character encoding conversion functionality in gettext, invoking the iconv_open() function. When executing the iconv_open() function during the loading of the gconv-modules configuration file, the path is computed with consideration of the GCONV_PATH environment variable. By substituting the gconv-modules file, one can arrange for the loading of a custom shared library during the output of the localized string by the login process.
CVE identifiers for the vulnerabilities mentioned have not yet been assigned. As a protective method, the use of a whitelist of acceptable values ("TERM", "DISPLAY", "USER", "LOGNAME", and "POSIXLY_CORRECT") is being considered, blocking all other environment variables, similar to how environment variables are handled in OpenSSH. The vulnerabilities have been confirmed in the GNU InetUtils package, which includes telnetd as deployed in Debian, Ubuntu, and their derivative distributions. Fixes for GNU InetUtils are currently unavailable. Rocky Linux 9 provides a modified telnetd that is not susceptible to the vulnerability, which instead uses whitelist checks rather than filtering dangerous environment variables. Whitelist filtering is also implemented in the telnetd from FreeBSD. In OpenBSD, telnetd was removed from the system in 2005. server Following the vulnerability discovered at the end of January, which allowed connecting as the root user without password verification, several privilege escalation methods have been identified in the telnetd server from the GNU InetUtils suite.
Source: opennet.ru
