{"id":154530,"date":"2026-01-20T23:11:56","date_gmt":"2026-01-20T21:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii"},"modified":"2026-01-20T23:11:56","modified_gmt":"2026-01-20T21:11:56","slug":"uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb telnetd q\u00eb lejon lidhjen me privilegje root pa autentifikim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb serverin telnetd nga paketa GNU InetUtils \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri q\u00eb lejon hyrjen si \u00e7do p\u00ebrdorues, p\u00ebrfshir\u00eb root, pa verifikim fjal\u00ebkalimi. Identifikuesi CVE ende nuk \u00ebsht\u00eb caktuar. Cenueshm\u00ebria shfaqet duke filluar nga versioni InetUtils 1.9.3 (viti 2015) dhe mbetet e paregulluar n\u00eb versionin aktual 2.7.0. Zgjidhja \u00ebsht\u00eb e disponueshme n\u00eb form\u00ebn e patch-eve (1, 2). <\/p>\n

Problemi \u00ebsht\u00eb shkaktuar nga fakti se p\u00ebr verifikimin e fjal\u00ebkalimit, procesi telnetd th\u00ebrret utilitarin \"\\\/usr\\\/bin\\\/login\", duke kaluar si argument emrin e p\u00ebrdoruesit, t\u00eb dh\u00ebn\u00eb nga klienti gjat\u00eb lidhjes me serverit<\/a>. Utilitari \"login\" mb \uc9c0\uc6d0 opcionin \"-f\", i cili lejon hyrjen pa realizuar autentikimin (n\u00ebnkuptohet se ky opsion p\u00ebrdoret kur p\u00ebrdoruesi \u00ebsht\u00eb verifikuar tashm\u00eb). Prandaj, n\u00ebse arrihet q\u00eb t\u00eb z\u00ebvend\u00ebsohet opsioni \"-f\" n\u00eb emrin e p\u00ebrdoruesit, mund t\u00eb lidhemi pa verifikim t\u00eb fjal\u00ebkalimit. <\/p>\n

N\u00eb lidhjen e zakonshme, p\u00ebrdorimi i emrit t\u00eb p\u00ebrdoruesit t\u00eb tipit \"-f root\" nuk do t\u00eb funksiononte, por n\u00eb telnet ka nj\u00eb mod t\u00eb automatizuar t\u00eb lidhjes, t\u00eb aktivizuar nga opsioni \"-a\". N\u00eb k\u00ebt\u00eb mod, emri i p\u00ebrdoruesit merret jo nga linja e komand\u00ebs, por kalohet n\u00ebp\u00ebrmjet variabl\u00ebs s\u00eb ambientit USER. Kur thirret utilitari login, vlera e k\u00ebsaj variabl\u00ebs ambienti z\u00ebvend\u00ebsohet pa kontroll t\u00eb m\u00ebtejsh\u00ebm dhe pa bashk\u00ebngjitje t\u00eb simboleve t\u00eb ve\u00e7anta. Prandaj, p\u00ebr t\u00eb u lidhur si p\u00ebrdorues root, mjafton t\u00eb vendosim n\u00eb variabl\u00ebn e ambientit USER vler\u00ebn \"-f root\" dhe t\u00eb lidhemi me serverin telnet, duke treguar opsionin \"-a\": $ USER='-f root' telnet -a emri_i_serverit <\/p>\n

Ndryshimi q\u00eb \u00e7oi n\u00eb k\u00ebt\u00eb cenueshm\u00ebri u shtua n\u00eb kodin e telnetd n\u00eb mars 2015 dhe lidhej me zgjidhjen e nj\u00eb problemi q\u00eb nuk lejonte p\u00ebrcaktimin e emrit t\u00eb p\u00ebrdoruesit n\u00eb regjimin autologin pa autentikim n\u00eb Kerberos. Si zgjidhje, u shtua mb\u00ebshtetja p\u00ebr kalimin e emrit t\u00eb p\u00ebrdoruesit p\u00ebr regjimin autologin p\u00ebrmes nj\u00eb ndryshoreje mjedisi, por u harrua t\u00eb shtohej verifikimi i vlefshm\u00ebris\u00eb s\u00eb emrit t\u00eb p\u00ebrdoruesit t\u00eb marr\u00eb nga ndryshorja e mjedisit.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f. CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 InetUtils 1.9.3 (2015 \u0433\u043e\u0434) \u0438 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 2.7.0. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0435\u0439 (1, 2). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-154530","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cenueshm\u00ebri n\u00eb telnetd q\u00eb lejon hyrjen me t\u00eb drejta root pa autentikim | ProHoster","description":"N\u00eb serverin telnetd nga paketa GNU InetUtils \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri q\u00eb lejon hyrjen si \u00e7do p\u00ebrdorues, p\u00ebrfshir\u00eb root, pa verifikim fjal\u00ebkalimi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 telnetd, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 telnetd \u0438\u0437 \u043d\u0430\u0431\u043e\u0440\u0430 GNU InetUtils \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root, \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-telnetd-pozvolyayushhaya-podklyuchitsya-s-pravami-root-bez-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-20T21:11:56+00:00","article:modified_time":"2026-01-20T21:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"154530","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:43:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 21:11:56","updated":"2026-02-09 21:43:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/154530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=154530"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/154530\/revisions"}],"predecessor-version":[{"id":160238,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/154530\/revisions\/160238"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=154530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=154530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=154530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}