Kevin Beaumont on Nostr: lol The telnetd server invokes /usr/bin/login (normally running as root) passing the ...
lol
https://seclists.org/oss-sec/2026/q1/89The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.
If the client supply a carefully crafted USER environment value being the string "-f root", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.
Published at
2026-01-20 20:49:14 UTCEvent JSON
{
"id": "5891530a25d4292ef67050dfc59293376de7bfcdd9f03466dac3c443e0604fa2",
"pubkey": "fe31a74ce7a735689686a4a8bdb765a8f4db945d91b67412c75058a82a51cffd",
"created_at": 1768942154,
"kind": 1,
"tags": [
[
"proxy",
"https://cyberplace.social/@GossiTheDog/115929393014353710",
"web"
],
[
"proxy",
"https://cyberplace.social/users/GossiTheDog/statuses/115929393014353710",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://cyberplace.social/users/GossiTheDog/statuses/115929393014353710",
"pink.momostr"
],
[
"-"
]
],
"content": "lol https://seclists.org/oss-sec/2026/q1/89\n\nThe telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environment variable received from the client as the last parameter.\n\nIf the client supply a carefully crafted USER environment value being the string \"-f root\", and passes the telnet(1) -a or --login parameter to send this USER environment to the server, the client will be automatically logged in as root bypassing normal authentication processes.",
"sig": "e45f35369c4587d840c4e5fbbb2cb315918d17e7d2c4110a5f1725f4a1f4f57b6b8754689fcb34cfbfb37e80138c6bc211fa25dfb1d5df7cec5edd00299b105d"
}
