{"id":154530,"date":"2026-01-20T23:11:56","date_gmt":"2026-01-20T21:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii"},"modified":"2026-01-20T23:11:56","modified_gmt":"2026-01-20T21:11:56","slug":"uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","title":{"rendered":"Zranite\u013enos\u0165 v telnetd, ktor\u00e1 umo\u017e\u0148uje pripoji\u0165 sa s pr\u00e1vami root bez autentifik\u00e1cie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Na serveri telnetd z bal\u00edka GNU InetUtils bola zisten\u00e1 zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje pripoji\u0165 sa ako ak\u00fdko\u013evek pou\u017e\u00edvate\u013e, vr\u00e1tane pou\u017e\u00edvate\u013ea root, bez overenia hesla. Identifik\u00e1tor CVE zatia\u013e nebol priraden\u00fd. Zranite\u013enos\u0165 sa prejavuje od verzie InetUtils 1.9.3 (2015) a zost\u00e1va neopravena v aktu\u00e1lnej verzii 2.7.0. Oprava je k dispoz\u00edcii vo forme z\u00e1plat (1, 2). <\/p>\n

Probl\u00e9m je sp\u00f4soben\u00fd t\u00fdm, \u017ee pri overovan\u00ed hesla proces telnetd vol\u00e1 n\u00e1stroj «\/usr\/bin\/login» a ako argument pred\u00e1va meno pou\u017e\u00edvate\u013ea zadan\u00e9 klientom pri pripojen\u00ed k serveru<\/a>. N\u00e1stroj «login» podporuje vo\u013ebu «-f», \u010do umo\u017e\u0148uje prihl\u00e1senie bez vykonania autentifik\u00e1cie (predpoklad\u00e1 sa, \u017ee t\u00e1to vo\u013eba sa pou\u017e\u00edva, ke\u010f pou\u017e\u00edvate\u013e u\u017e pre\u0161iel overen\u00edm). Tak\u017ee ak sa podar\u00ed vlo\u017ei\u0165 vo\u013ebu «-f» do mena pou\u017e\u00edvate\u013ea, je mo\u017en\u00e9 sa pripoji\u0165 bez kontroly hesla. <\/p>\n

Pri be\u017enom pripojen\u00ed nie je mo\u017en\u00e9 pou\u017ei\u0165 meno pou\u017e\u00edvate\u013ea vo forme «-f root», ale v telnet existuje re\u017eim automatick\u00e9ho pripojenia, ktor\u00fd je aktivovan\u00fd vo\u013ebou «-a». V tomto re\u017eime sa meno pou\u017e\u00edvate\u013ea nezoberie z pr\u00edkazov\u00e9ho riadku, ale pred\u00e1 sa cez premenn\u00fa prostredia USER. Pri vyvolan\u00ed n\u00e1stroja login sa hodnota tejto premennej prostredia dosadila bez dodato\u010dnej kontroly a bez escapovania \u0161peci\u00e1lnych znakov. Tak\u017ee na pripojenie ako pou\u017e\u00edvate\u013e root sta\u010d\u00ed nastavi\u0165 v premennej prostredia USER hodnotu «-f root» a pripoji\u0165 sa k telnet-serveru s ur\u010den\u00edm vo\u013eby «-a»: $ USER=’-f root’ telnet -a meno_servera <\/p>\n

Zmeny, ktor\u00e9 viedli k zranite\u013enosti, boli pridan\u00e9 do k\u00f3du telnetd v marci 2015 a boli spojen\u00e9 s odstr\u00e1nen\u00edm probl\u00e9mu, ktor\u00fd neumo\u017e\u0148oval ur\u010di\u0165 meno pou\u017e\u00edvate\u013ea v re\u017eime autologin bez autentifik\u00e1cie v Kerberos. Ako rie\u0161enie bola pridan\u00e1 podpora prenosu mena pou\u017e\u00edvate\u013ea pre re\u017eim autologin cez premenn\u00fa prostredia, ale na overenie spr\u00e1vnosti mena pou\u017e\u00edvate\u013ea z premennej prostredia sa zabudlo.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 InetUtils 1.9.3 (2015 \u0433\u043e\u0434) \u0438 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 2.7.0. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0435\u0439 (1, 2). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-154530","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v telnetd, ktor\u00e1 umo\u017e\u0148uje pripoji\u0165 sa s pr\u00e1vami root bez autentifik\u00e1cie | ProHoster","description":"Na serveri telnetd z bal\u00edka GNU InetUtils bola zisten\u00e1 zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje pripoji\u0165 sa ako ak\u00fdko\u013evek pou\u017e\u00edvate\u013e, vr\u00e1tane pou\u017e\u00edvate\u013ea root, bez overenia hesla.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 telnetd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-20T21:11:56+00:00","article:modified_time":"2026-01-20T21:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"154530","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:43:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 21:11:56","updated":"2026-02-09 21:43:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/154530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=154530"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/154530\/revisions"}],"predecessor-version":[{"id":160238,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/154530\/revisions\/160238"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=154530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=154530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=154530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}