Kevin Beaumont
lol https://seclists.org/oss-sec/2026/q1/89
The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.
If the client supply a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.
Kevin Beaumont
Bug was introduced after this report https://lists.gnu.org/archive/html/bug-inetutils/2014-12/msg00012.html
Kevin Beaumont
For elder security greybeards, you may remember this is almost the exact same bug that Solaris introduced a decade before 🫡
Face Thumb
@GossiTheDog I wonder if 3 letter agencies knew about this? And I wonder if they've used it against a handful of industrial sites over the years? And it is probably close to useless these days as most people have hopefully moved on to SSH and VPNs?
Rich Felker
@GossiTheDog No, that's the thing. It doesn't pass it "as the last parameter". Instead it wrongly pastes it into the end of a shell command string (and without proper quoting) and tells the shell to parse it as a command. If it psssed it properly as the last parameter everything would be fine.
Rich Felker
@leon_p_smith @GossiTheDog It's not difficult at all. One trivial way is putting ' at start and end after replacing every ' with '\''.
Leon P Smith
@dalias @GossiTheDog my understanding is that "proper quoting" in a shell context is nigh impossible...
Rich Felker
@leon_p_smith @GossiTheDog But the right solution is not to paste at all. Instead invoke the shell as something like "sh", "-c", "expanded_command_here", "sh", [parameters here] and insead of expanding % codes directly in the expanded command, replacing them with "$1", "$2", etc. to pull the parameters.
None of this is hard. It's something you should already know how to do right if you're invoking a shell from a potentially privileged context with data from another privilege domain. If you don't already know how to do it, you should not be touching software that runs in such a context.
Rich Felker
@cjwatson @leon_p_smith @GossiTheDog The approach I described is as an array, not a string of shell input. The expanded command doesn't contain any of the variable input text, just positional references to it.
Colin Watson
@dalias @leon_p_smith @GossiTheDog That's perhaps a mild improvement, but still leaves you open to shell mistakes. Far better is to construct the correct argv array directly, as an array and _not_ as a string of shell input.
It is notable that the inetutils fix did not take this approach, but instead patches things up with (hopefully correct) argument sanitization. I'm not going to rag on people for making a mistake once, but after being bitten once they should really know better.
Rich Felker
@cjwatson @leon_p_smith @GossiTheDog As an example to see how this works, run:
sh -c 'echo "$1"' sh "foo bar"
Rich Felker
@cjwatson @leon_p_smith @GossiTheDog It's needed because -E takes a shell command string with special substitutions (bad interface choice someone made long ago).
Colin Watson
@dalias @leon_p_smith @GossiTheDog I'm well aware of how it works. But if you don't have to involve the shell (and I can't see why it would be needed in the case at hand - the templating arrangement doesn't need to be particularly flexible), why bother introducing unnecessary complexity?
Kevin Beaumont
The telnetd vuln has a CVE now - CVE-2026-24061
Proof of concept: https://github.com/SafeBreach-Labs/CVE-2026-24061/blob/main/telnet_rce.py
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.