Following the vulnerability discovered at the end of January, which allowed connecting as the root user without password verification, several privilege escalation methods were found in the telnetd server from the GNU InetUtils suite, resulting from the incomplete elimination of a vulnerability in 1999 (CVE-1999-0073). <\/p>\n
The vulnerabilities are caused by the ability of the telnetd to transmit environment variables from the client to the server using the ENVIRON option. Such environment variables are set and processed in the context of the telnetd process and passed to its child processes, including the \/bin\/login process launched with root privileges. The CVE-1999-0073 vulnerability allowed the telnet client to pass the LD_LIBRARY_PATH environment variable, which causes the specified shared library to be loaded when the login process starts. If the attacker can upload files to a system supporting telnet protocol connections, they can upload a specially crafted library and set it to load with root privileges. <\/p>\n
In telnetd from the GNU InetUtils package, a vulnerability was fixed by blocking dangerous environment variables through filtering for the masks \u2018LD_\u2019, \u2018LIBPATH\u2019, \u2018ENV\u2019, \u2018IFS\u2019, and \u2018_RLD_\u2019. However, the environment variable \u2018CREDENTIALS_DIRECTORY\u2019 remained unblocked, which is processed at the start of \/usr\/bin\/login. Using this environment variable, a user could change the directory for credential settings and place a login.noauth file with the value \u2018yes\u2019 in the new directory, allowing password-less login (similar to passing the \u2018-f\u2019 flag to the login process). This setting applies to all users, including root. <\/p>\n
The attack involves an unprivileged user creating a subdirectory in their home directory, uploading a login.noauth file to it, and attempting to log in by setting the environment variable \u2018CREDENTIALS_DIRECTORY=created_directory\u2019 and passing the environment variable \u2018USER=root\u2019 (telnet has an automatic login mode where the username is taken not from the command line, but passed through the USER environment variable). Here\u2019s an exploit example. <\/p>\n
Another method of gaining root access through telnetd has been identified, related to manipulating the environment variables OUTPUT_CHARSET and LANGUAGE, processed by the GNU gettext library, and the environment variable GCONV_PATH used in glibc. By setting the environment variables OUTPUT_CHARSET and LANGUAGE, an attacker can enable character encoding conversion functionality in gettext, invoking the iconv_open() function. When executing the iconv_open() function during the loading of the gconv-modules configuration file, the path is computed with consideration of the GCONV_PATH environment variable. By substituting the gconv-modules file, one can arrange for the loading of a custom shared library during the output of the localized string by the login process. <\/p>\n
CVE identifiers have not yet been assigned to the noted vulnerabilities. A method of protection being considered involves using a whitelist of acceptable values (\u2018TERM\u2019, \u2018DISPLAY\u2019, \u2018USER\u2019, \u2018LOGNAME\u2019, and \u2018POSIXLY_CORRECT\u2019) while blocking all other environment variables, similar to how environment variables are handled in OpenSSH. The vulnerabilities have been confirmed in the GNU InetUtils package. server<\/a> Following the vulnerability discovered at the end of January, which allowed connecting as the root user without password verification, several privilege escalation methods have been identified in the telnetd server from the GNU InetUtils suite. \u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0435\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f, \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u0441\u0442\u0430\u0432\u0448\u0438\u0445 \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435\u043c \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 1999 \u0433\u043e\u0434\u0443 (CVE-1999-0073). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0432 telnetd \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u043f\u0446\u0438\u0438 ENVIRON. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-162791","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"A series of new vulnerabilities in telnetd, allowing root privileges to be gained in the system | ProHoster","description":"\ud83e\udd47A series of new vulnerabilities in telnetd, allowing root privileges to be gained in the system | ProHoster","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/seriya-novyh-uyazvimostej-v-telnetd-pozvolyayushhih-poluchit-root-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0440\u0438\u044f \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 telnetd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0435\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f, \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/seriya-novyh-uyazvimostej-v-telnetd-pozvolyayushhih-poluchit-root-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-25T15:11:54+00:00","article:modified_time":"2026-02-25T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"162791","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-25 15:12:53","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-25 15:11:55","updated":"2026-02-25 15:12:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/162791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=162791"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/162791\/revisions"}],"predecessor-version":[{"id":165657,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/162791\/revisions\/165657"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=162791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=162791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=162791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"