{"id":155278,"date":"2026-01-26T11:12:14","date_gmt":"2026-01-26T09:12:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya"},"modified":"2026-01-26T11:12:14","modified_gmt":"2026-01-26T09:12:14","slug":"login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","title":{"rendered":"Prihlasovacie meno, medzera, poml\u010dka, root. Chyba v telnet umo\u017e\u0148uje prevzia\u0165 po\u010d\u00edta\u010d bez hesla","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zranite\u013enos\u0165 v bal\u00edku GNU InetUtils zasiahla v\u0161etky verzie od 1.9.3 do 2.7 vr\u00e1tane.<\/p>\n

Na prv\u00fd poh\u013ead sa zdalo, \u017ee telnet d\u00e1vno patr\u00ed minulosti spolu s modemmi a dial-up pripojen\u00edm, ale pr\u00e1ve on sa n\u00e1hle stal zdrojom v\u00e1\u017enej zranite\u013enosti. V GNU InetUtils bol objaven\u00fd bug, ktor\u00fd umo\u017e\u0148uje vzdialen\u00fd pr\u00edstup do syst\u00e9mu ako root bez hesla, sta\u010d\u00ed posla\u0165 \u0161peci\u00e1lne formovan\u00fd hodnotou premennej prostredia.<\/p>\n

Probl\u00e9m sa t\u00fdka servera telnetd, ktor\u00fd je s\u00fa\u010das\u0165ou GNU InetUtils. Tento server odovzd\u00e1va programu login hodnotu premennej USER, z\u00edskan\u00fa od klienta, bez ak\u00e9hoko\u013evek overenia. M\u00f4\u017ee to by\u0165 zneu\u017eit\u00e9, ak klient po\u0161le re\u0165azec \"-f root\" ako USER a pripoj\u00ed sa s parametrom telnet -a alebo –login. V\u00fdsledkom je, \u017ee login to interpretuje ako slu\u017eobn\u00fa vlajku, presko\u010d\u00ed \u0161tandardn\u00fd proces autentifik\u00e1cie a automaticky autorizuje pou\u017e\u00edvate\u013ea ako root.<\/p>\n

Zranite\u013enos\u0165 dostala identifik\u00e1tor CVE-2026-24061 a hodnotenie pod\u013ea CVSS: 9.8. Ohrozen\u00e9 s\u00fa v\u0161etky verzie GNU InetUtils, po\u010d\u00ednaj\u00fac verziou 1.9.3 a\u017e po 2.7 vr\u00e1tane. Bug je v projekte takmer 11 rokov, od m\u00e1ja 2015, ale bol identifikovan\u00fd a\u017e teraz. V podstate ide o klasick\u00fd pr\u00edklad star\u0161ej \u0161koly zranite\u013enosti, kde nebezpe\u010dn\u00fd re\u0165azec bez filtr\u00e1cie je pren\u00e1\u0161an\u00fd syst\u00e9mov\u00e9mu n\u00e1stroju s privil\u00e9giami root.<\/p>\n

Autori ozn\u00e1menia priamo odpor\u00fa\u010daj\u00fa v\u00f4bec nepou\u017e\u00edva\u0165 telnetd, obmedzi\u0165 pr\u00edstup k telnet portu len na d\u00f4veryhodn\u00fdch klientov a \u010do najr\u00fdchlej\u0161ie nain\u0161talova\u0165 opravu alebo prejs\u0165 na verziu, v ktorej bol probl\u00e9m odstr\u00e1nen\u00fd. Do\u010dasn\u00fdm rie\u0161en\u00edm m\u00f4\u017ee by\u0165 \u00fapln\u00e9 vypnutie telnetd alebo pou\u017eitie vlastnej verzie login, ktor\u00e1 nepodporuje parameter \u201e-f\u201c.<\/p>\n

Zranite\u013enos\u0165 objavil v\u00fdskumn\u00edk Carlos Cortes \u00c1lvarez, oprava bola pripraven\u00e1 a dopracovan\u00e1 v\u00fdvoj\u00e1rmi GNU InetUtils v janu\u00e1ri 2026. Opravy zah\u0155\u0148aj\u00fa sanitiz\u00e1ciu v\u0161etk\u00fdch premenn\u00fdch, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa pri formovan\u00ed pr\u00edkazu login, aby bolo tak\u00e9to \u00fatoky principi\u00e1lne nemo\u017en\u00e9.<\/p>\n

Pr\u00edbeh vyzer\u00e1 takmer symbolicky: zastaran\u00fd protokol, zabudovan\u00e1 slu\u017eba a klasick\u00e1 logick\u00e1 chyba viedli k \u00faplnej kompromit\u00e1cii syst\u00e9mu. \u010eal\u0161ie pripomienka, \u017ee aj \u201estar\u00e9\u201c technol\u00f3gie m\u00f4\u017eu na\u010falej predstavova\u0165 re\u00e1lnu hrozbu, ak s\u00fa st\u00e1le v prev\u00e1dzke.<\/p>\n

Ihne\u010f po zverejnen\u00ed inform\u00e1ci\u00ed o zranite\u013enosti t\u00edm v\u00fdskumn\u00edkov nasadil honeypot senzory, aby sledoval skuto\u010dn\u00e9 pokusy o zneu\u017eitie. \u00dato\u010dn\u00edci na seba nedali dlho \u010daka\u0165. Po\u010das 18 hod\u00edn pozorovan\u00ed bolo zaznamenan\u00fdch 60 pokusov o hackovanie od 18 jedine\u010dn\u00fdch IP adresy<\/a>. Pod\u013ea \u00fadajov platformy Censys bolo potenci\u00e1lne zranite\u013en\u00fdch pribli\u017ene tri tis\u00edcky syst\u00e9mov po celom svete, hoci zna\u010dn\u00e1 \u010das\u0165 z nich pravdepodobne tie\u017e bola honeypot n\u00e1strahami.<\/p>\n

Anal\u00fdza zachytenej prev\u00e1dzky uk\u00e1zala ve\u013emi pestr\u00fa situ\u00e1ciu. Najakt\u00edvnej\u0161\u00ed bol \u00fato\u010dn\u00edk z adresy 178.16.53.82, ktor\u00fd vykonal 12 rel\u00e1ci\u00ed proti 10 r\u00f4znym cie\u013eom. Jeho \u010dinnosti boli \u00faplne automatizovan\u00e9: po z\u00edskan\u00ed pr\u00edstupu sa spustil \u0161tandardn\u00fd s\u00fabor pr\u00edkazov na prieskum ako napr\u00edklad uname -a, id, \u010d\u00edtanie \/proc\/cpuinfo a \/etc\/passwd. Charakteristick\u00fdm rysom sa stalo obalenie v\u00fdstupu pr\u00edkazov \u0161peci\u00e1lnymi zna\u010dkami pre n\u00e1sledn\u00e9 spracovanie, \u010do jasne nazna\u010duje botnet alebo automatizovan\u00fd syst\u00e9m zberu d\u00e1t.<\/p>\n

Ove\u013ea sofistikovanej\u0161\u00ed bol \u00fato\u010dn\u00edk z adresy 216.106.186.24. Zameral sa na konkr\u00e9tnu podsiete a sna\u017eil sa nastavi\u0165 SSH k\u013e\u00fa\u010d pre trval\u00fd pr\u00edstup, ako aj nahra\u0165 a spusti\u0165 Python skript z extern\u00e9ho servera \u2013 predpoklad\u00e1 sa, \u017ee ide o malware na kryptomining alebo botnet. Pravda, oba pokusy zlyhali: na cie\u013eovom syst\u00e9me neexistoval adres\u00e1r .ssh a taktie\u017e ch\u00fdbali curl a python.<\/p>\n

Osobitn\u00fd z\u00e1ujem vyvol\u00e1vaj\u00fa dvaja \u00fato\u010dn\u00edci s adresami 167.172.111.135 a 165.22.30.48. Na rozdiel od ostatn\u00fdch sa okam\u017eite nepok\u00fasili z\u00edska\u0165 root pr\u00edstup, ale experimentovali s \u00fa\u010dtami nobody, daemon a dokonca aj neexistuj\u00facou nonexistent123. oneskorenia medzi rel\u00e1ciami a logika ich akci\u00ed nazna\u010duj\u00fa, \u017ee za kl\u00e1vesnicou je \u017eiv\u00fd \u010dlovek. Pravdepodobne ide o sk\u00fasenej\u0161\u00edch hackerov, ktor\u00ed vedia o syst\u00e9moch na detekciu vniknutia a maj\u00fa v z\u00e1sobe techniky na zvy\u0161ovanie privil\u00e9gi\u00ed.<\/p>\n

Niektor\u00ed \u00fato\u010dn\u00edci uk\u00e1zali ohromuj\u00facu nedbanlivos\u0165 v prev\u00e1dzkovom zabezpe\u010den\u00ed. Napr\u00edklad \u00fato\u010dn\u00edk z adresy 67.220.95.16 pou\u017e\u00edval t\u00fa ist\u00fa IP adresu na vykon\u00e1vanie \u00fatokov aj na hostenie servera s malv\u00e9rom. In\u00ed n\u00e1hodou odhalili n\u00e1zvy svojich hostite\u013eov prostredn\u00edctvom premennej DISPLAY: jeden pracoval na syst\u00e9me s n\u00e1zvom MiniBear, in\u00fd na virtu\u00e1lnej stroji shared-vm2.localdomain, a tret\u00ed sa dokonca prip\u00e1jal priamo z plnohodnotn\u00e9ho grafick\u00e9ho prostredia Kali Linux.<\/p>\n

Celkovo bol \u00farove\u0148 \u00fato\u010dn\u00edkov celkom n\u00edzka. Z 18 zdrojov \u00fatokov len nieko\u013eko vyk\u00e1zalo znaky profesionality. V\u00e4\u010d\u0161ina vyu\u017e\u00edvala najjednoduch\u0161ie automatizovan\u00e9 n\u00e1stroje alebo doslova poklep\u00e1vala na kl\u00e1vesnici, riadiac sa pokynmi z internetu. Syst\u00e9m detekcie naru\u0161enia Suricata \u00faspe\u0161ne zachytil moment z\u00edskania root pr\u00edstupu jedn\u00fdm z \u00fato\u010dn\u00edkov, \u010do op\u00e4\u0165 potvrdzuje d\u00f4le\u017eitos\u0165 viac\u00farov\u0148ovej ochrany a monitorovania sie\u0165ov\u00e9ho prenosu.<\/p>\n

V\u00fdskumn\u00edci poznamen\u00e1vaj\u00fa, \u017ee t\u00e1to zranite\u013enos\u0165, na jednej strane, dala pr\u00edle\u017eitos\u0165 hackerom-amat\u00e9rom precvi\u010di\u0165 sa, a na druhej strane, umo\u017enila odborn\u00edkom na bezpe\u010dnos\u0165 zhroma\u017edi\u0165 cenn\u00e9 \u00fadaje o aktu\u00e1lnych taktik\u00e1ch a n\u00e1strojoch zlo\u010dincov.<\/p>\n

<\/p>\n

Podrobnej\u0161ie: https:\/\/www.securitylab.ru\/news\/568478.php<\/a><\/p>\n

<\/noindex><\/noindex><\/p>\n

Zdroj: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 GNU InetUtils \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0431\u0430\u0433, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-155278","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Prihl\u00e1senie, medzera, poml\u010dka, root. Chyba v telnet umo\u017e\u0148uje prevzia\u0165 po\u010d\u00edta\u010d bez hesla | ProHoster","description":"Zranite\u013enos\u0165 v bal\u00edku GNU InetUtils ovplyvnila v\u0161etky verzie od 1.9.3 do 2.7 vr\u00e1tane. Zdalo by sa, \u017ee telnet u\u017e d\u00e1vno odi\u0161iel do minulosti spolu s modemami a dial-up, no pr\u00e1ve on sa n\u00e1hle stal zdrojom v\u00e1\u017eneho.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u043e\u0433\u0438\u043d, \u043f\u0440\u043e\u0431\u0435\u043b, \u0434\u0435\u0444\u0438\u0441, root. \u0411\u0430\u0433 \u0432 telnet \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 GNU InetUtils \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 1.9.3 \u043f\u043e 2.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, telnet \u0434\u0430\u0432\u043d\u043e \u0443\u0448\u0435\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u0435 \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043c\u043e\u0434\u0435\u043c\u0430\u043c\u0438 \u0438 dial-up, \u043d\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u043e\u043d \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u043e \u0441\u0442\u0430\u043b \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u043c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/login-probel-defis-root-bag-v-telnet-pozvolyaet-zahvatit-kompyuter-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-26T09:12:14+00:00","article:modified_time":"2026-01-26T09:12:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"155278","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:42:45","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-26 09:12:14","updated":"2026-02-08 20:42:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/155278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=155278"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/155278\/revisions"}],"predecessor-version":[{"id":158081,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/155278\/revisions\/158081"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=155278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=155278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=155278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}