Dup\u0103 identificarea vulnerabilit\u0103\u021bii de la sf\u00e2r\u0219itul lunii ianuarie, care permitea conectarea ca utilizator root f\u0103r\u0103 verificarea parolei, au fost descoperite mai multe metode de cre\u0219tere a privilegiilor \u00een serverul telnetd din pachetul GNU InetUtils, ca urmare a remedierii incomplete a vulnerabilit\u0103\u021bii din 1999 (CVE-1999-0073). <\/p>\n
Vulnerabilit\u0103\u021bile sunt cauzate de existen\u021ba \u00een telnetd a posibilit\u0103\u021bii de a transmite variabile de mediu de c\u0103tre client c\u0103tre server prin op\u021biunea ENVIRON. Astfel de variabile de mediu sunt setate \u0219i procesate \u00een contextul procesului telnetd \u0219i sunt transmise proceselor fiice lansate de acesta, inclusiv procesului \/bin\/login, care ruleaz\u0103 cu drepturi de root. Vulnerabilitatea CVE-1999-0073 permitea clientului telnet s\u0103 transmit\u0103 variabila de mediu LD_LIBRARY_PATH, setarea c\u0103reia duce la \u00eenc\u0103rcarea bibliotecii partajate specificate de utilizator la lansarea procesului login. \u00cen cazul \u00een care sunt posibile \u00eenc\u0103rc\u0103ri de fi\u0219iere \u00een sistemul care suport\u0103 conexiuni prin protocolul telnet, un atacator poate \u00eenc\u0103rca o bibliotec\u0103 special conceput\u0103 \u0219i poate organiza \u00eenc\u0103rcarea acesteia cu drepturi de root. <\/p>\n
\u00cen telnetd din pachetul GNU InetUtils, vulnerabilitatea a fost remediat\u0103 prin interzicerea variabilelor de mediu periculoase prin filtrarea acestora dup\u0103 m\u0103\u0219tile \u201eLD_\u201d, \u201eLIBPATH\u201d, \u201eENV\u201d, \u201eIFS\u201d \u0219i \u201e_RLD_\u201d. Totu\u0219i, variabila de mediu \u201eCREDENTIALS_DIRECTORY\u201d a r\u0103mas nelimitat\u0103, fiind procesat\u0103 la pornirea \/usr\/bin\/login. Prin aceast\u0103 variabil\u0103 de mediu, utilizatorul putea schimba directorul cu set\u0103rile de acreditive \u0219i putea plasa un fi\u0219ier login.noauth cu valoarea \u201eyes\u201d, activ\u00e2nd astfel accesul f\u0103r\u0103 parol\u0103 (similar cu transmiterea flag-ului \u201e-f\u201d procesului login). Setarea se aplic\u0103 pentru to\u021bi utilizatorii, inclusiv root. <\/p>\n
Atacul const\u0103 \u00een crearea de c\u0103tre un utilizator f\u0103r\u0103 privilegii a unui subdirector \u00een directorul s\u0103u home, \u00eenc\u0103rcarea unui fi\u0219ier login.noauth \u00een acesta \u0219i \u00eencercarea de autentificare cu setarea variabilei de mediu \u201eCREDENTIALS_DIRECTORY=directorul creat\u201d \u0219i transmiterea variabilei de mediu \u201eUSER=root\u201d (\u00een telnet exist\u0103 un mod de conectare automat\u0103, \u00een care numele utilizatorului este preluat nu din linia de comand\u0103, ci transmis prin variabila de mediu USER). Exemplu de exploit. <\/p>\n
A fost descoperit\u0103 o alt\u0103 modalitate de a ob\u021bine acces root prin telnetd, legat\u0103 de manipularea variabilelor de mediu OUTPUT_CHARSET \u0219i LANGUAGE, procesate de biblioteca GNU gettext, \u0219i a variabilei de mediu GCONV_PATH, utilizat\u0103 \u00een glibc. Prin setarea variabilelor de mediu OUTPUT_CHARSET \u0219i LANGUAGE, un atacator poate activa \u00een gettext func\u021bionalitatea de conversie a codific\u0103rii caracterelor, apel\u00e2nd func\u021bia iconv_open(). La r\u00e2ndul s\u0103u, \u00een timpul execut\u0103rii func\u021biei iconv_open() la \u00eenc\u0103rcarea fi\u0219ierului de configurare gconv-modules, calea este calculat\u0103 av\u00e2nd \u00een vedere variabila de mediu GCONV_PATH. Prin substituirea fi\u0219ierului gconv-modules se poate organiza \u00eenc\u0103rcarea unei biblioteci partajate personalizate \u00een timpul afi\u0219\u0103rii unei string localizate de c\u0103tre procesul login. <\/p>\n
CVE-urile pentru vulnerabilit\u0103\u021bile marcate nu au fost \u00eenc\u0103 atribuite. Ca metod\u0103 de protec\u021bie, se ia \u00een considerare utilizarea unei liste albe de valori acceptate (\u201eTERM\u201d, \u201eDISPLAY\u201d, \u201eUSER\u201d, \u201eLOGNAME\u201d \u0219i \u201ePOSIXLY_CORRECT\u201d) cu blocarea tuturor celorlalte variabile de mediu, similar cu modul \u00een care sunt gestionate variabilele de mediu \u00een OpenSSH. Vulnerabilit\u0103\u021bile au fost confirmate \u00een pachetul GNU InetUtils, implementarea server<\/a> telnetd care este livrat \u00een Debian, Ubuntu \u0219i distribu\u021bii derivate. Corec\u021biile pentru GNU InetUtils nu sunt disponibile \u00eenc\u0103. \u00cen Rocky Linux 9 este livrat un telnetd modificat, care nu este vulnerabil, \u00een care, \u00een locul filtr\u0103rii variabilelor de mediu periculoase, este inclus\u0103 o verificare bazat\u0103 pe lista alb\u0103. Filtrarea pe baza listei albe este implementat\u0103 \u0219i \u00een telnetd din FreeBSD. \u00cen OpenBSD telnetd a fost exclus din sistem \u00een 2005. \u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0435\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f, \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u0441\u0442\u0430\u0432\u0448\u0438\u0445 \u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435\u043c \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 1999 \u0433\u043e\u0434\u0443 (CVE-1999-0073). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u044b \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0432 telnetd \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u043f\u0446\u0438\u0438 ENVIRON. \u041f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-162791","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47O serie de noi vulnerabilit\u0103\u021bi \u00een telnetd, care permit ob\u021binerea privilegiilor root \u00een sistem | ProHoster","description":"Dup\u0103 vulnerabilitatea descoperit\u0103 la sf\u00e2r\u0219itul lunii ianuarie care permitea conectarea sub utilizatorul root f\u0103r\u0103 verificarea parolei, \u00een serverul telnetd din pachetul GNU InetUtils au fost identificate mai multe metode de a-\u0219i cre\u0219te privilegiile.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/seriya-novyh-uyazvimostej-v-telnetd-pozvolyayushhih-poluchit-root-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0440\u0438\u044f \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 telnetd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0435\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c root \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f, \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/seriya-novyh-uyazvimostej-v-telnetd-pozvolyayushhih-poluchit-root-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-25T15:11:54+00:00","article:modified_time":"2026-02-25T15:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"162791","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-25 15:12:53","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-25 15:11:55","updated":"2026-02-25 15:12:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/162791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=162791"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/162791\/revisions"}],"predecessor-version":[{"id":165657,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/162791\/revisions\/165657"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=162791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=162791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=162791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"