A GNU InetUtils telnetd server vulnerability has been identified that allows connection as any user, including the root user, without password verification. No CVE identifier has been assigned yet. The vulnerability exists starting from InetUtils version 1.9.3 (2015) and remains unpatched in the current release 2.7.0. A fix is available in the form of patches (1, 2).
The issue is caused by the fact that the telnetd process calls the utility "/usr/bin/login" to check the password, passing the username specified by the client during connection to. szerverhez. The "login" utility supports the "-f" option which allows a user to log in without authentication (it is implied that this option is used when the user has already been verified). Thus, if the "-f" option is substituted into the username, one can connect without password verification.
With a regular connection, using a username like "-f root" is not possible, but telnet has an automatic connection mode activated by the "-a" option. In this mode, the username is not taken from the command line but is passed through the USER environment variable. When the login utility is called, the value of this environment variable is substituted without additional checking and without escaping special characters. Therefore, to connect as the root user, it is enough to set the USER environment variable to "-f root" and connect to the telnet server by specifying the "-a" option: $ USER='-f root' telnet -a server_name
The change that led to the vulnerability was added to the telnetd code in March 2015 and was related to solving a problem that prevented determining the username in autologin mode without authentication in Kerberos. To resolve this, support was added for passing the username for autologin mode through an environment variable, but the check for the validity of the username from the environment variable was forgotten.
Forrás: opennet.ru
