Re: Telnetd Vulnerability Report

Ron Ben Yizhak <[email protected]> Wed, 18 Feb 2026 15:41:00 +0200
Newsgroups gmane.comp.gnu.inetutils.bugs
Message-ID <CAB1hGqTHdp238pQK8khVrMSsYuJRmWkXEBsqm9XXwHgpqSq1jQ@mail.gmail.com>
--00000000000056af5b064b1957e2
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

That is perfect. Thank you!

On Wed, Feb 18, 2026 at 3:21=E2=80=AFPM Erik Auerswald <[email protected]=
i-kl.de>
wrote:

> Hi,
>
> I think it would be fine to adjust the attribution, would something like
> the following be OK?
>
> ----------------8<----------------
> diff --git a/NEWS.md b/NEWS.md
> index f5172a71..2d575efa 100644
> --- a/NEWS.md
> +++ b/NEWS.md
> @@ -8,7 +8,7 @@ improvements and security advisory by Simon Josefsson.
>
>  ** Prevent privilege escalation via telnetd abusing systemd service
>  credentials support added to the login(1) implementation of util-linux
> -in release 2.40.  Reported by Ron Ben Yizhak in
> +in release 2.40.  Reported by Ron Ben Yizhak@SafeBreach in
>  <https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>=
.
>
>  ** telnet: Drop everything related to TN3270.
> diff --git a/THANKS b/THANKS
> index ef5f6063..f6e725f1 100644
> --- a/THANKS
> +++ b/THANKS
> @@ -10,7 +10,7 @@ In particular:
>    Nathan Neulinger       (tftpd)
>    Thomas Bushnell        (sockaddr sin_len field)
>    Kyu Neushwaistein      (reported remote root exploit in telnetd)
> -  Ron Ben Yizhak         (reported privilege escalation via telnetd)
> +  Ron Ben Yizhak@SafeBreach (reported privilege escalation via telnetd)
>
>  Please see version control logs and ChangeLog.? for full credits.
>
> ---------------->8----------------
>
> Any objections?
>
> Cheers,
> Erik
>
>
> On Mon, Feb 16, 2026 at 02:03:01PM +0200, Ron Ben Yizhak wrote:
> > Hi,
> >
> > Thank you for handling my report and fixing the vulnerability. As this
> > finding was done as part of my job at SafeBreach, it is very important
> for
> > us that SafeBreach will be mentioned in the patch.
> > Could you please change the THANKS and NEWS.md file to say Ron Ben
> > Yizhak@SafeBreach instead of Ron Ben Yizhak?
> >
> > Also, when will a CVE be assigned for this vulnerability?
> > Thank you,
> > Ron Ben Yizhak
> >
> > On Sun, Feb 15, 2026 at 7:21=E2=80=AFPM Erik Auerswald <
> [email protected]>
> > wrote:
> >
> > > Hi Simon,
> > >
> > > On Sun, Feb 15, 2026 at 04:36:56PM +0100, Simon Josefsson wrote:
> > > > Erik Auerswald <[email protected]> writes:
> > > >
> > > > > I plan to commit and push the attached patch in a few days to
> address
> > > > > this vulnerability, unless there are reasonable objections.
> > > >
> > > > Thanks -- I wish we could implement the --accept-env approach and
> make
> > > > the default not set any environment variables at all, but I don't
> have
> > > > cycles to work on that.  Anyone else?
> > >
> > > Me neither.
> > >
> > > > Your patch seems to close this vulnerability report in a most minim=
al
> > > > way, so IMHO we should apply it.
> > >
> > > I have just applied it.
> > >
> > > Cheers,
> > > Erik
>

--00000000000056af5b064b1957e2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<div><br></div><div>That is perfect. Thank you!</div></=
div><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" c=
lass=3D"gmail_attr">On Wed, Feb 18, 2026 at 3:21=E2=80=AFPM Erik Auerswald =
&lt;<a href=3D"mailto:[email protected]">[email protected]=
e</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin=
:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"=
>Hi,<br>
<br>
I think it would be fine to adjust the attribution, would something like<br=
>
the following be OK?<br>
<br>
----------------8&lt;----------------<br>
diff --git a/NEWS.md b/NEWS.md<br>
index f5172a71..2d575efa 100644<br>
--- a/NEWS.md<br>
+++ b/NEWS.md<br>
@@ -8,7 +8,7 @@ improvements and security advisory by Simon Josefsson.<br>
<br>
=C2=A0** Prevent privilege escalation via telnetd abusing systemd service<b=
r>
=C2=A0credentials support added to the login(1) implementation of util-linu=
x<br>
-in release 2.40.=C2=A0 Reported by Ron Ben Yizhak in<br>
+in release 2.40.=C2=A0 Reported by Ron Ben Yizhak@SafeBreach in<br>
=C2=A0&lt;<a href=3D"https://lists.gnu.org/archive/html/bug-inetutils/2026-=
02/msg00000.html" rel=3D"noreferrer" target=3D"_blank">https://lists.gnu.or=
g/archive/html/bug-inetutils/2026-02/msg00000.html</a>&gt;.<br>
<br>
=C2=A0** telnet: Drop everything related to TN3270.<br>
diff --git a/THANKS b/THANKS<br>
index ef5f6063..f6e725f1 100644<br>
--- a/THANKS<br>
+++ b/THANKS<br>
@@ -10,7 +10,7 @@ In particular:<br>
=C2=A0 =C2=A0Nathan Neulinger=C2=A0 =C2=A0 =C2=A0 =C2=A0(tftpd)<br>
=C2=A0 =C2=A0Thomas Bushnell=C2=A0 =C2=A0 =C2=A0 =C2=A0 (sockaddr sin_len f=
ield)<br>
=C2=A0 =C2=A0Kyu Neushwaistein=C2=A0 =C2=A0 =C2=A0 (reported remote root ex=
ploit in telnetd)<br>
-=C2=A0 Ron Ben Yizhak=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(reported privilege=
 escalation via telnetd)<br>
+=C2=A0 Ron Ben Yizhak@SafeBreach (reported privilege escalation via telnet=
d)<br>
<br>
=C2=A0Please see version control logs and ChangeLog.? for full credits.<br>
<br>
----------------&gt;8----------------<br>
<br>
Any objections?<br>
<br>
Cheers,<br>
Erik<br>
<br>
<br>
On Mon, Feb 16, 2026 at 02:03:01PM +0200, Ron Ben Yizhak wrote:<br>
&gt; Hi,<br>
&gt; <br>
&gt; Thank you for handling my report and fixing the vulnerability. As this=
<br>
&gt; finding was done as part of my job at SafeBreach, it is very important=
 for<br>
&gt; us that SafeBreach will be mentioned in the patch.<br>
&gt; Could you please change the THANKS and NEWS.md file to say Ron Ben<br>
&gt; Yizhak@SafeBreach instead of Ron Ben Yizhak?<br>
&gt; <br>
&gt; Also, when will a CVE be assigned for this vulnerability?<br>
&gt; Thank you,<br>
&gt; Ron Ben Yizhak<br>
&gt; <br>
&gt; On Sun, Feb 15, 2026 at 7:21=E2=80=AFPM Erik Auerswald &lt;<a href=3D"=
mailto:[email protected]" target=3D"_blank">[email protected]=
l.de</a>&gt;<br>
&gt; wrote:<br>
&gt; <br>
&gt; &gt; Hi Simon,<br>
&gt; &gt;<br>
&gt; &gt; On Sun, Feb 15, 2026 at 04:36:56PM +0100, Simon Josefsson wrote:<=
br>
&gt; &gt; &gt; Erik Auerswald &lt;<a href=3D"mailto:[email protected]=
.de" target=3D"_blank">[email protected]</a>&gt; writes:<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; &gt; I plan to commit and push the attached patch in a few d=
ays to address<br>
&gt; &gt; &gt; &gt; this vulnerability, unless there are reasonable objecti=
ons.<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; Thanks -- I wish we could implement the --accept-env approac=
h and make<br>
&gt; &gt; &gt; the default not set any environment variables at all, but I =
don&#39;t have<br>
&gt; &gt; &gt; cycles to work on that.=C2=A0 Anyone else?<br>
&gt; &gt;<br>
&gt; &gt; Me neither.<br>
&gt; &gt;<br>
&gt; &gt; &gt; Your patch seems to close this vulnerability report in a mos=
t minimal<br>
&gt; &gt; &gt; way, so IMHO we should apply it.<br>
&gt; &gt;<br>
&gt; &gt; I have just applied it.<br>
&gt; &gt;<br>
&gt; &gt; Cheers,<br>
&gt; &gt; Erik<br>
</blockquote></div>

--00000000000056af5b064b1957e2--