{"id":155278,"date":"2026-01-26T11:12:14","date_gmt":"2026-01-26T09:12:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya"},"modified":"2026-01-26T11:12:14","modified_gmt":"2026-01-26T09:12:14","slug":"login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","title":{"rendered":"Login, spa\u021biu, cratim\u0103, root. O eroare \u00een telnet permite capturarea computerului f\u0103r\u0103 parol\u0103.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O vulnerabilitate din pachetul GNU InetUtils a afectat toate versiunile de la 1.9.3 la 2.7 inclusiv.<\/p>\n

De\u0219i telnet p\u0103rea c\u0103 a disp\u0103rut \u00eempreun\u0103 cu modems \u0219i dial-up, acesta a devenit brusc sursa unei vulnerabilit\u0103\u021bi serioase. Un bug a fost descoperit \u00een GNU InetUtils, care permite accesul la sistem ca root f\u0103r\u0103 parol\u0103, trimitz\u00e2nd pur \u0219i simplu o valoare specific\u0103 a variabilei de mediu.<\/p>\n

Problema afecteaz\u0103 serverul telnetd, care face parte din GNU InetUtils. Acesta transmite programului login valoarea variabilei USER, primit de la client, f\u0103r\u0103 nicio verificare. Aceasta poate fi exploatat\u0103, dac\u0103 clientul trimite \u0219irul \u201e-f root\u201d ca USER \u0219i se conecteaz\u0103 cu parametrul telnet -a sau \u2013login. Ca urmare, login interpreteaz\u0103 acest lucru ca un flag de serviciu, s\u0103rind peste procedura standard de autentificare \u0219i autoriz\u00e2nd automat utilizatorul ca root.<\/p>\n

Vulnerabilitatea a primit identificatorul CVE-2026-24061 \u0219i o evaluare CVSS de 9.8. Toate versiunile GNU InetUtils, de la 1.9.3 la 2.7 inclusiv, sunt afectate. Bugul exist\u0103 \u00een proiect de aproape 11 ani, din mai 2015, dar a fost identificat abia acum. Practic, este un exemplu clasic de vulnerabilitate de tip vechi, unde un \u0219ir periculos f\u0103r\u0103 filtrare este transmis unei utilit\u0103\u021bi de sistem cu privilegii root.<\/p>\n

Autorii advisory recomand\u0103 \u00een mod clar s\u0103 nu se utilizeze deloc telnetd, s\u0103 se limiteze accesul la portul telnet doar pentru clien\u021bi de \u00eencredere \u0219i s\u0103 se instaleze c\u00e2t mai repede un patch sau s\u0103 se fac\u0103 upgrade la o versiune care a rezolvat problema. O solu\u021bie temporar\u0103 poate fi dezactivarea complet\u0103 a telnetd sau utilizarea unei versiuni personalizate de login care nu accept\u0103 parametrul \u201e-f\u201d.<\/p>\n

Vulnerabilitatea a fost descoperit\u0103 de cercet\u0103torul Carlos Cortes Alvarez, iar patch-ul a fost preg\u0103tit \u0219i \u00eembun\u0103t\u0103\u021bit de dezvoltatorii GNU InetUtils \u00een ianuarie 2026. Corec\u021biile includ sanitizarea tuturor variabilelor utilizate la formarea comenzii de apelare a login-ului, astfel \u00eenc\u00e2t astfel de atacuri s\u0103 devin\u0103 imposibile \u00een principiu.<\/p>\n

Povestea pare aproape simbolic\u0103: un protocol \u00eenvechit, un serviciu uitat \u0219i o eroare de logic\u0103 clasic\u0103 au dus la compromiterea complet\u0103 a sistemului. O alt\u0103 amintire c\u0103 chiar \u0219i tehnologiile \u201evechi\u201d pot r\u0103m\u00e2ne o amenin\u021bare real\u0103 dac\u0103 \u00eenc\u0103 mai func\u021bioneaz\u0103 \u00een produc\u021bie.<\/p>\n

Imediat dup\u0103 publicarea informa\u021biilor despre vulnerabilitate, echipa de cercet\u0103tori a desf\u0103\u0219urat senzori honeypot pentru a urm\u0103ri \u00eencerc\u0103rile reale de exploatare. Atacatorii nu s-au l\u0103sat a\u0219tepta\u021bi. \u00cen cadrul observa\u021biilor de 18 ore, au fost \u00eenregistrate 60 de \u00eencerc\u0103ri de hacking din 18 surse unice. adreselor IP<\/a>. Potrivit platformei Censys, aproximativ trei mii de sisteme din \u00eentreaga lume s-au dovedit a fi vulnerabile, de\u0219i o parte semnificativ\u0103 dintre acestea sunt, probabil, tot honeypot-uri.<\/p>\n

Analiza traficului interceptat a ar\u0103tat o imagine foarte diversificat\u0103. Cel mai activ a fost atacatorul cu adresa 178.16.53.82, care a desf\u0103\u0219urat 12 sesiuni \u00eempotriva a 10 \u021binte diferite. Ac\u021biunile sale au fost complet automatizate: dup\u0103 ob\u021binerea accesului, se derula un set standard de comenzi de recunoa\u0219tere, precum uname -a, id, citirea \/proc\/cpuinfo \u0219i \/etc\/passwd. O caracteristic\u0103 remarcabil\u0103 a fost \u00eenf\u0103\u0219urarea ie\u0219irilor comenzilor cu marcaje speciale pentru parsarea ulterioar\u0103, ceea ce indic\u0103 clar un botnet sau un sistem automatizat de colectare a datelor.<\/p>\n

Un atacator mai sofisticat s-a dovedit a fi cel cu adresa 216.106.186.24. Acesta s-a concentrat pe o subre\u021bea specific\u0103 \u0219i a \u00eencercat s\u0103 stabileasc\u0103 o cheie SSH pentru acces permanent, precum \u0219i s\u0103 \u00eencarce \u0219i s\u0103 execute un script Python de pe un server extern \u2014 presupus software mali\u021bios pentru minarea de criptomonede sau botnet. Totu\u0219i, ambele \u00eencerc\u0103ri au e\u0219uat: pe sistemul \u021bint\u0103 nu exista un director .ssh, iar curl \u0219i python erau absente.<\/p>\n

Un interes deosebit \u00eel reprezint\u0103 doi atacatori cu adresele 167.172.111.135 \u0219i 165.22.30.48. Spre deosebire de ceilal\u021bi, ace\u0219tia nu au \u00eencercat imediat s\u0103 ob\u021bin\u0103 acces root, ci au experimentat cu conturile nobody, daemon \u0219i chiar cu inexistentul nonexistent123. \u00cent\u00e2rzierile \u00eentre sesiuni \u0219i logica ac\u021biunilor sugereaz\u0103 c\u0103 exist\u0103 o persoan\u0103 real\u0103 \u00een spatele tastaturii. Probabil, ace\u0219tia sunt hackeri mai experimenta\u021bi, care sunt con\u0219tien\u021bi de sistemele de detectare a intruziunilor \u0219i au tehnici de ridicare a privilegiilor la dispozi\u021bie.<\/p>\n

Unii atacatori au demonstrat o neglijen\u021b\u0103 surprinz\u0103toare \u00een ceea ce prive\u0219te securitatea opera\u021bional\u0103. De exemplu, un atacator cu adresa 67.220.95.16 a folosit aceea\u0219i adres\u0103 IP at\u00e2t pentru exploatare, c\u00e2t \u0219i pentru g\u0103zduirea unui server cu software r\u0103u inten\u021bionat. Al\u021bii au dezv\u0103luit din \u00eent\u00e2mplare numele gazdelor lor prin variabila DISPLAY: unul lucra de pe un sistem numit MiniBear, altul de pe o ma\u0219in\u0103 virtual\u0103 shared-vm2.localdomain, iar un altul s-a conectat direct dintr-un mediu grafic complet Kali Linux.<\/p>\n

\u00cen general, nivelul atacatorilor a fost destul de sc\u0103zut. Din 18 surse de atac, doar c\u00e2teva au demonstrat semne de profesionalism. Majoritatea au utilizat instrumente automatizate simple sau au lovit pur \u0219i simplu tastele, urm\u00e2nd instruc\u021biunile de pe internet. Sistemul de detec\u021bie a intruziunilor Suricata a detectat cu succes momentul \u00een care un atacator a ob\u021binut acces root, ceea ce reconfirm\u0103 importan\u021ba unei protec\u021bii \u00een mai multe straturi \u0219i a monitoriz\u0103rii traficului de re\u021bea.<\/p>\n

Cercet\u0103torii noteaz\u0103 c\u0103 aceast\u0103 vulnerabilitate, pe de o parte, a oferit oportunitatea hackerilor amatori de a exersa, iar pe de alt\u0103 parte, a permis speciali\u0219tilor \u00een securitate s\u0103 colecteze date valoroase despre tacticile \u0219i instrumentele actuale ale atacatorilor.<\/p>\n

<\/p>\n

Mai multe detalii: https:\/\/www.securitylab.ru\/news\/568478.php<\/a><\/p>\n

<\/noindex><\/noindex><\/p>\n

Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 GNU InetUtils \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-155278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Login, spa\u021biu, cratim\u0103, root. Bugul \u00een telnet permite preluarea unui computer f\u0103r\u0103 parol\u0103 | ProHoster","description":"Vulnerabilitatea din pachetul GNU InetUtils a afectat toate versiunile de la 1.9.3 p\u00e2n\u0103 la 2.7 inclusiv. Se p\u0103rea c\u0103 telnet a disp\u0103rut de mult, odat\u0103 cu modemurile \u0219i dial-up-ul, dar exact el a devenit brusc o surs\u0103 serioas\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0433\u0438\u043d, \u043f\u0440\u043e\u0431\u0435\u043b, \u0434\u0435\u0444\u0438\u0441, root. \u0411\u0430\u0433 \u0432 telnet \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-26T09:12:14+00:00","article:modified_time":"2026-01-26T09:12:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"155278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:42:45","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-26 09:12:14","updated":"2026-02-08 20:42:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/155278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=155278"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/155278\/revisions"}],"predecessor-version":[{"id":158081,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/155278\/revisions\/158081"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=155278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=155278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=155278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}